HOW TO AUTH: SECURE A GRAPHQL API WITH CONFIDENCE MANDI WISE | - PowerPoint PPT Presentation

Mar 02, 2023 •107 likes •347 views

HOW TO AUTH: SECURE A GRAPHQL API WITH CONFIDENCE MANDI WISE | GRAPHQL SUMMIT 2020 AGENDA Authentication Authorization Federation GRAPHQL SUMMIT 2020 AUTH AUTHENTICATION AUTHORIZATION YOU ARE WHO YOU SAY YOU ARE YOU CAN DO WHAT YOU WANT

HOW TO AUTH: SECURE A GRAPHQL API WITH CONFIDENCE MANDI WISE | GRAPHQL SUMMIT 2020
AGENDA Authentication Authorization Federation GRAPHQL SUMMIT 2020
AUTH AUTHENTICATION AUTHORIZATION YOU ARE WHO YOU SAY YOU ARE YOU CAN DO WHAT YOU WANT TO DO
AUTHENTICATION: YOU ARE WHO YOU SAY YOU ARE
STARTING POINT We don’t want to lockdown our entire GraphQL endpoint We’re going to use JSON Web Tokens for auth We’ll use Express with Apollo Server GRAPHQL SUMMIT 2020
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ey JodHRwczovL3NwYWNlYXBpLmNvbS9ncmFwaHFsI jp7InJvbGVzIjpbImFzdHJvbmF1dCJdLCJwZXJt aXNzaW9ucyI6WyJyZWFkOm93bl91c2VyIl19LCJ pYXQiOjE1OTQyNTI2NjMsImV4cCI6MTU5NDMzOT A2Mywic3ViIjoiNjc4OTAifQ.Z1JPE53ca1Jaxw DTlnofa3hwpS0PGdRLUMIrC7M3FCI
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ey JodHRwczovL3NwYWNlYXBpLmNvbS9ncmFwaHFsI jp7InJvbGVzIjpbImFzdHJvbmF1dCJdLCJwZXJt aXNzaW9ucyI6WyJyZWFkOm93bl91c2VyIl19LCJ pYXQiOjE1OTQyNTI2NjMsImV4cCI6MTU5NDMzOT A2Mywic3ViIjoiNjc4OTAifQ.Z1JPE53ca1Jaxw DTlnofa3hwpS0PGdRLUMIrC7M3FCI
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ey JodHRwczovL3NwYWNlYXBpLmNvbS9ncmFwaHFsI jp7InJvbGVzIjpbImFzdHJvbmF1dCJdLCJwZXJt aXNzaW9ucyI6WyJyZWFkOm93bl91c2VyIl19LCJ pYXQiOjE1OTQyNTI2NjMsImV4cCI6MTU5NDMzOT A2Mywic3ViIjoiNjc4OTAifQ.Z1JPE53ca1Jaxw DTlnofa3hwpS0PGdRLUMIrC7M3FCI
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ey JodHRwczovL3NwYWNlYXBpLmNvbS9ncmFwaHFsI jp7InJvbGVzIjpbImFzdHJvbmF1dCJdLCJwZXJt aXNzaW9ucyI6WyJyZWFkOm93bl91c2VyIl19LCJ pYXQiOjE1OTQyNTI2NjMsImV4cCI6MTU5NDMzOT A2Mywic3ViIjoiNjc4OTAifQ.Z1JPE53ca1Jaxw DTlnofa3hwpS0PGdRLUMIrC7M3FCI
DEMO TIME…
AUTHORIZATION: YOU CAN DO WHAT YOU WANT TO DO
A FEW OPTIONS Handle auth logic directly in each resolver function GRAPHQL SUMMIT 2020
A FEW OPTIONS Handle auth logic directly in each resolver function Create custom directives (e.g. @auth(requires: DIRECTOR) ) Wrap resolver functions (e.g. GraphQL Auth) Abstract auth rules into middleware (e.g. GraphQL Shield) GRAPHQL SUMMIT 2020
NOW DO FEDERATION
SUMMING UP Handle incoming tokens in the context A viewer query can be an entry point for authenticated users Keep explicit authorization checks out of resolver functions Forward header from gateway API using buildService GRAPHQL SUMMIT 2020
SHOW ME THE CODE! https://github.com/mandiwise/basic-apollo-auth-demo https://github.com/mandiwise/apollo-federation-auth-demo https://github.com/mandiwise/graphql-magic-auth-demo GRAPHQL SUMMIT 2020
THANKS! TWITTER & GITHUB: @MANDIWISE

Recommend

MOEBIUS Mobility Management Application Niavi Stefania AUTh IT Center Liolios Nikos AUTh

MOEBIUS Mobility Management Application Niavi Stefania AUTh IT Center Liolios Nikos AUTh Department of European Educational Programmes 1 Moebius - AUTh, Greece Main challenges of mobility management 1. Large volume of bilateral agreements

483 views • 30 slides

O H! H! Auth th Implementation pitfalls & the auth providers who have fell in it

H! H! O H! H! Auth th Implementation pitfalls & the auth providers who have fell in it @samitanwer1 samit.anwer@gmail.com C: C:\>whoami Samit Anwer Product Security Team @Citrix Web/Mobile App Security Enthusiast

724 views • 58 slides

Message Authentication Codes Auth. with MAC Security Algorithms CSS441: Security and

CSS441 Introduction Functions Auth. with Encryption Message Authentication Codes Auth. with MAC Security Algorithms CSS441: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by

673 views • 21 slides

Turning AUTh into e-University Pinelopi Giovanitsa, Academic Support IT Center introduction 2

Turning AUTh into e-University Pinelopi Giovanitsa, Academic Support IT Center introduction 2 learning management systems in AUTh centra eClass blackboard moodle 3 timeline of transition September 2014 March 2014 eLearning on

526 views • 16 slides

Web Security and Auth Shan-Hung Wu CS, NTHU Outline Security risks of web applications

Web Security and Auth Shan-Hung Wu CS, NTHU Outline Security risks of web applications Injection, broken authentication , XSS, CSRF, etc. Checklist of 23 Node.js security best practices Auth: Authentication, authorization, and

336 views • 30 slides

General LTL Specification Mining Caroline Lemieux , Dennis Park and Ivan Beschastnikh University

login attempt auth failed login attempt guest login login attempt authorized Texada auth failed login attempt G( x XF y ) login attempt G( guest login XF authorized ) guest login authorized auth failed login attempt Authorized

1.11k views • 59 slides

Let us l s lea ead d you ou t to a an AUTH THENT NTIC TE TEXAS RA RANC NCH E EXPERI

Let us l s lea ead d you ou t to a an AUTH THENT NTIC TE TEXAS RA RANC NCH E EXPERI RIENC NCE!!! JUST ST 2 25 MINU INUTES f fro rom DO DOWNTOWN SA SAN ANTONI NIO Guests Choose fro rom one of our r thre ree Uniq ique

187 views • 16 slides

Scientific Program HMC2016 4th Historic Mortars Conference Organizing Committee Papayianni

HMC2016 4th Historic Mortars Conference Scientific Program HMC2016 4th Historic Mortars Conference Organizing Committee Papayianni Ioanna Professor AUTH Stefanidou Maria Associate Professor AUTH Palyvou Clairy Emeritus Professor AUTH Pachta

95 views • 5 slides

Afzaal zaal Mau auth thoor oor Mad Scientist. Travel Entrepreneur. Philanthropist Co

Afzaal zaal Mau auth thoor oor Mad Scientist. Travel Entrepreneur. Philanthropist Co Co-found under er - Inspi pired ed Esca capes pes Founder der - The e Philanth lanthropy y Club b London on In every rything thing I do I

326 views • 16 slides

Environmental Informatics ICT for the Environment Kostas Karatzas Informatics Applications

Environmental Informatics ICT for the Environment Kostas Karatzas Informatics Applications and Systems Group Dept. of Mechanical E ngineering Aristotle University of Thessaloniki kkara@ eng.auth.gr , http:/ / isag.meng.auth.gr

1.56k views • 107 slides

Big Data Analytics with Apache Apostolos N. Papadopoulos (Associate Prof.)

chiPSet Training School, September 2017, Novi Sad, Serbia Big Data Analytics with Apache Apostolos N. Papadopoulos (Associate Prof.) (papadopo@csd.auth.gr, http://datalab.csd.auth.gr/~apostol) Data Science & Engineering Lab Department of

934 views • 81 slides

Introduction to the urban environment Kostas Karatzas Informatics A pplications and Systems

Introduction to the urban environment Kostas Karatzas Informatics A pplications and Systems Group Dept. of Mechanical E ngineering A ristotle University of Thessalonik i k k ara@ eng.auth.gr , http:/ / isag.meng.auth.gr Contents Part A:

983 views • 76 slides

An Information-Theoretic Approach to Detecting Changes in Multi-Dimensional Data Streams Auth

An Information-Theoretic Approach to Detecting Changes in Multi-Dimensional Data Streams Auth thors: Presentatio ion: Dasu, T., Krishnan, S., Vincent Chu Venkatasubramanian, S., 22 November 2017 & Yi, K. (2006). Content Introduction

512 views • 48 slides

An Introduction to Apostolos N. Papadopoulos (papadopo@csd.auth.gr) Assistant Professor Data

An Introduction to Apostolos N. Papadopoulos (papadopo@csd.auth.gr) Assistant Professor Data Engineering Lab Department of Informatics Aristotle University of Thessaloniki Thessaloniki Greece 1 Outline What is Spark? Basic features

951 views • 64 slides

CMC's & The FCA Jeremy Smith Director B-Compliant Ltd Do I I need to be auth thoris

CMC's & The FCA Jeremy Smith Director B-Compliant Ltd Do I I need to be auth thoris ised? CMR Regulated Seeking out persons who may have a claim Referring details of a claim or potential claim or potential claimant to another

96 views • 7 slides

Usi Using Stew tewar ardsh ship Au Auth thor ority y to Advan to Advance ce Restor

Collaborative restoration Workshop april, 2016 Usi Using Stew tewar ardsh ship Au Auth thor ority y to Advan to Advance ce Restor Restorati tion on Rebecca B cca Barn rnar ard National Forestry Programs Manager

669 views • 21 slides

45nm High-k + Metal Gate Strain-Enhanced Transistors C. Auth, A. Cappellani, J.-S. Chun, A.

45nm High-k + Metal Gate Strain-Enhanced Transistors C. Auth, A. Cappellani, J.-S. Chun, A. Dalis, A. Davis, T. Ghani, G. Glass, T. Glassman, M. Harper, M. Hattendorf, P. Hentges, S. Jaloviar, S. Joshi, J. Klaus, K. Kuhn, D. Lavric, M. Lu, H.

1.17k views • 42 slides

Faecal Sludge Treatment and Utilization by Hydrothermal Carbonization Process Auth thor ors s

Faecal Sludge Treatment and Utilization by Hydrothermal Carbonization Process Auth thor ors s : Krail ilak Fakkaew Thammara mmarat Koo oott ttatep Ch Chon ongrak rak Pol olpras asert 1 IN INTR TRODUCT ODUCTION ION 2 INTR IN

614 views • 18 slides

Au Auth thor orin ing g KNAR NARTs Andrew M. Simms, PhD Clinical Informatics Scientist

Au Auth thor orin ing g KNAR NARTs Andrew M. Simms, PhD Clinical Informatics Scientist Cognitive Medical Systems Background KN owledge ART ifact A computable representation of clinical knowledge Documentation Templates

498 views • 8 slides

Like NSA Pre-auth RCE on Leading SSL VPNs Orange Tsai (@orange_8361) Meh Chang (@mehqq_) Orange

Infiltrating Corporate Intranet Like NSA Pre-auth RCE on Leading SSL VPNs Orange Tsai (@orange_8361) Meh Chang (@mehqq_) Orange Tsai Principal security researcher at DEVCORE Captain of HITCON CTF team 0day researcher, focusing on

1.98k views • 121 slides

Kern ern Grou roundwater Auth thor orit ity GSP Framework W k Worksh shop Apri ril 4 4,

Kern ern Grou roundwater Auth thor orit ity GSP Framework W k Worksh shop Apri ril 4 4, , 2017 Groundwater Sustainability Plan Outlines Overview Analysis Approach GSP Sections Overview Umbrella/Chapter GSP Outline

895 views • 32 slides

Th The P Pas assenger Ferry y Gr Gran ant P Program am Sta tatu tuto tory ry Au Auth

Th The P Pas assenger Ferry y Gr Gran ant P Program am Sta tatu tuto tory ry Au Auth thori rity ty Section 5307(h) Passenger Ferry Grant Program Authorizes FTA to award on a competitive basis for passenger ferry projects that

585 views • 10 slides

Philippine S e Stati tatisti tics Auth uthor ority ty Provin incia ial St Statis istic

Philippine S e Stati tatisti tics Auth uthor ority ty Provin incia ial St Statis istic ics Of Offic ice On On-goi oing S Stati tatisti tical al A Acti tiviti ties Ev Evelyn O O. Apell llid ido S upervis isin ing S

324 views • 17 slides

TH THE PORT RT AU AUTH THORI RITY OF NEW YORK & NEW JERSEY Port Briefing December 2018

TH THE PORT RT AU AUTH THORI RITY OF NEW YORK & NEW JERSEY Port Briefing December 2018 The Port Starts from a Position of Strength The port has 6 major container terminals, covering 1,500 acres. Serving every major ocean

330 views • 12 slides