The Root of Auth Thingz
summary
Claims that relationship or graph-based permission models reduce authorization bypass in federated GraphQL setups and proposes implementing a Zanzibar-like system to centralize checks. Cites surprising measurements: 54% of GraphQL CVE findings are auth bypasses and 87.3% from PackerOne link to auth issues. Mentions concrete tools and paths: policy engines (Oso, Casbin, Rego), hosted and OSS Zanzibar clones (Authzed/Zed, OpenFGA, SpiceDB, ORY Keto), changing schema directives to call the external relationship check and migrating existing role/attribute data.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:34Authorization needs attention
- 3:18GraphQL auth vulnerabilities
- 5:04Mental models for auth
- 7:53RBAC and its limits
- 10:38Policy-based access control
- 13:04GraphQL Shield enforcement
- 14:48Context in authorization
- 16:13Graph-based access control
- 18:45Zanzibar in authorization
- 20:30Zanzibar with GraphQL
- 21:16Implementing Zanzibar-like systems
- 23:00Auth tools and open-source
- 24:03Recap and closing
related talks
06mThe Root of Auth Things
16mAccess Granted with AuthZed
29mAuthz as a dev workflow
32mAuthz as a Dev Workflow: Architecting Better Cloud Native Apps
54mFine-Grained Authorization for Modern Applications
05mAre you talking about Auth with and N or a Z?
45mThe Future of Authorization in Applications
27mAuthorization in the GraphQL era