Q24: Where should Authentication and Authorization be handled in GraphQL?
Difficulty:IntermediateTopic:Security
- Authentication (who you are): Should occur in HTTP middleware before the GraphQL engine receives the request. The validated user context is then attached to the resolver
context. - Authorization (what you can do): Should ideally be enforced in the business/domain logic layer rather than inside individual GraphQL resolver functions to keep code maintainable and dry.
Key Takeaways
- Authenticate at the HTTP layer, attach credentials to
context. - Enforce granular domain authorization within data service models.
Knowledge Check
Where is the recommended architectural location to place core business authorization rules?