All 15 GraphQL questions
More in GraphQL
How would you handle file uploads in a GraphQL API, given GraphQL's standard JSON-based transport doesn't naturally support binary file data? What is the purpose of GraphQL's non-null (!) type modifier, and what happens if a resolver for a non-null field returns null unexpectedly? What is the difference between a GraphQL scalar type and an object type, and how would you define a custom scalar (like DateTime) in a Node.js GraphQL server? What is the N+1 query problem in GraphQL specifically, and how does DataLoader solve it? How would you implement query complexity analysis or depth limiting in a GraphQL API to prevent a maliciously deep or expensive query from overwhelming the server? How would you implement GraphQL schema stitching or federation to compose a single unified GraphQL API from multiple underlying microservices? How would you implement caching for a GraphQL API, given that unlike REST, a single endpoint serves widely varying query shapes that don't map cleanly to standard HTTP caching? How would you write automated tests for GraphQL resolvers in Node.js, testing them independently of the full HTTP/schema execution layer?
Advertisement
Back to results for “Passport)”
Node.js › GraphQL

How would you implement authentication and authorization in a GraphQL API in Node.js, given there's typically only a single HTTP endpoint?

Advanced

Answer

Authentication is typically handled the same way as a REST API -- verifying a JWT or session from the request headers before the GraphQL execution begins, attaching the resulting user object to a shared 'context' object that Apollo Server passes to every resolver -- authorization then happens inside individual resolvers (or via a dedicated directive like @auth applied directly in the schema), checking the authenticated user from context against the specific field or operation being accessed, since GraphQL's single endpoint means you can't rely on route-level middleware the way a REST API might for path-specific authorization.
const server = new ApolloServer({
  typeDefs, resolvers,
  context: async ({ req }) => {
    const user = await verifyToken(req.headers.authorization);
    return { user };
  },
});

const resolvers = {
  Mutation: {
    deletePost: (_, { id }, context) => {
      if (!context.user || context.user.role !== 'admin') throw new GraphQLError('Forbidden');
      return db.posts.delete(id);
    },
  },
};
Real-world example A GraphQL API authenticates every incoming request once at the context-creation step, then checks the resulting context.user's role inside each sensitive resolver (like deletePost) individually, since GraphQL's single-endpoint design means authorization can't be scoped by URL path the way it commonly is in a REST API.

Common follow-ups: How would you implement a reusable authorization check that applies consistently across many resolvers without duplicating the check logic everywhere?;What's the tradeoff of field-level authorization (checking inside individual resolvers) versus a schema-level directive-based approach?

Authentication & Authorization (JWT OAuth Passport);Security
All 15 GraphQL questions