Authorization in GraphQL: Peanut Butter and Chocolate - Sam Scott

Building authorization is hard in GraphQL because of the changes it makes to the relationship between client and server in web application APIs. In traditional REST APIs, servers statically define their endpoints and responses. By contrast, GraphQL lets clients submit arbitrary queries to the server. This flexibility, which makes GraphQL APIs so appealing, is also the property that makes it difficult to add authorization to them. In the REST world, you can (at a minimum) authorize individual endpoints. In the bright GraphQL future, you have to find a way to generically authorize each query and mutation. In this talk we’ll talk about these challenges and explore different solutions and tradeoffs for building authorization into GraphQL apps.