Comments (3)
The GraphQL specification doesn’t tell you how to do authentication or authorization. It can be a bit confusing to developers who are new to GraphQL. I don’t claim to have all the answers, so if you have a different idea or a different opinion, feel free to share that in the comments so we can all learn together!
- Let the web server (e.g. express or nginx) take care of authentication or a micro service like auth server.
- Handle authentication in GraphQL itself.
I am fan of SRP (single responsibility principle), GraphQL for the query, the endpoint for consuming the data and the authentication server for what you know ... Like major compagnies with Oauth ...
In my point I don't think it's a good choice to handle it into the graphql endpoints as it is a single endpoint...what you can do if you want to make the full endpoint private?
from canduma.
In the Node.js ecosystem there is good tooling around authorization inside the GraphQL schema itself, to give some examples:
I don't have the experience in Rust to give some examples in how I could do it here, but it's specially convenient for the client side to use the same tooling used for the GraphQL schema (Apollo / Relay / urql /gqless, etc...) while doing the authentication process, simply using mutations, instead of hacking around extra logic just for the current_user / login / sign_up / logout.
from canduma.
And it raises another question, how can I expose some parts of the GraphQL Schema of this template to be open without authorization?
from canduma.
Related Issues (20)
- Suggested way to add new model HOT 2
- Redis session cookies (with one remember_me). HOT 3
- Implementing OAuth server HOT 4
- Better HTTP Response HOT 3
- Rust 1.39.0 and Async/Await HOT 21
- Consider using wundergraph for the database <-> GraphQL interaction HOT 1
- Cargo run failed HOT 1
- Get JWT Token, get No HOT 4
- Consider Heroku compatibility HOT 1
- discussion: async-graphql vs jupiter and diesel vs tokio-postgres vs sqlx HOT 1
- Connection pooling via r2d2 crate HOT 2
- Cannot query field "token" on type "QueryRoot" HOT 1
- Implementing tests and documentation HOT 8
- [ Feature Request ] support cursor-based pagination HOT 1
- Diesel 2.0 released with errors when updating
- Add Redis session backend.
- Federation support for GraphQL
- Console command scaffolding to add routes, handlers, models, managers etc ... HOT 5
- Implementing cargo-generate and make the templates.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from canduma.