Authorization in the GraphQL era
summary
Walks through concrete Rails examples and code: keeps Devise login outside the graph, passes current_user in context and shows using GraphQL Ruby visibility to hide fields, warns to disable schema introspection in prod. Demonstrates integrating CanCan/Pundit limitations and advocates Action Policy with its GraphQL helpers, adds a resolver callback that enforces policy checks (GitHub gist linked), covers data scoping, caching of rule evaluation for performance, and gives test strategies and pitfalls.
AI-written summary · about
chapters (32)
- 0:00Intro
- 2:29TATARSTAN
- 3:50Standard Rails App
- 4:14Rails DHH way
- 4:28Standard* Rails App
- 5:14GraphQL Rails App
- 5:57GraphQL Internals
- 8:25Ensuring Authentication
- 9:07The One Entrypoint
- 11:26Visibility Extension
- 12:32Why Is Visibility Better? GraphQL Introspection
- 12:53Hide Parts of Your Schema
- 14:06Authorization is Flexible
- 14:24GraphQL Authorization
- 15:16Ability For Each Action ACCESS CONTROL LAYER
- 15:46Ability For Each Node
- 16:101+ Endpoints for Sets of Fields
- 16:29Yes, but...
- 17:01GraphQL Pro
- 17:23Who Has Heard about gem "action_policy"?
- 17:39gem "action_policy" The Authorization Framework
- 18:33Handling Exceptions
- 19:08Scoping Data
- 20:03UI/UX
- 21:33Hot Abilities
- 22:02Let's Cache it!
- 22:23Why We Are Talking Only About Reading Data?
- 22:46Mutations
- 23:13Ensuring Policies are Used
- 23:49Only Integration Tests
- 24:24Bad Auth Tests
- 25:20Conclusion
related talks
41mAccess Denied: the missing guide to authorization in Rails
41mThe GraphQL Way: A new path for JSON APIs
09mFlexible Authorization:Storing and Managing Rules in DB
23mAuthorization in GraphQL: Peanut Butter and Chocolate
40mAuthentication and Authorization in GraphQL
25mThe Root of Auth Thingz
23mBuilding APIs you want to hug with GraphQL
24mOptimizing for API Consumers with GraphQL