Secure GraphQL queries with express js, passport s

Question

I have started using graphql in my express js project but i am wondering how to protect some of my GraphQL query. Previously i used passport js(JWT) for this and that works gre

Answer 1

I'm currently evaluating the potential of authorization over resolvers with express, passport and jwt. It's not fully tested, but it works.

For this to work, you need to pass at least the request in the context:

const graphql = graphqlExpress((req, res) => {
  return ({
    schema,
    rootValue: resolver,
    // For query authorization. Ideally, Passport will handle all requests and authenticate
    // each one for the current user. The queries will fetch data exclusively related to that user.
    context: { req, res },
  });
});
// The api
app.use('/api', graphql);

In this case I promisified the passport authentication:

const auth = (req, res) => new Promise((resolve, reject) => {
  passport.authenticate('jwt', { session: false }, (err, user) => {
    if (err) reject(err);
    if (user) resolve(user);
    else reject('Unauthorized');
  })(req, res);
});

const resolver = {
  users: (root, ctx) => auth(ctx.req, ctx.res)
    .then(() => User.find({}, (err, res) => res))
    .catch((err) => {
      throw new Error(err);
    }),
};

Since there's not that many examples on how to cover this, I've struggled to make it simple, but I think I did it well.

Here are the resources I used to get to this point:

• how to get passport.authenticate local strategy working with async/await pattern
• https://matoski.com/article/jwt-express-node-mongoose/
• https://dev-blog.apollodata.com/auth-in-graphql-part-2-c6441bcc4302