Authorization and Security Best Practices

# CHAPTER 16

Authorization and Security Best Practices #

1. Introduction #

2. Learning Objectives #

• Differentiate between Authentication and Authorization.

• Implement Role-Based Access Control inside your GraphQL resolvers.

• Understand the threat of recursive queries and how to stop them using Depth Limiting.

• Explain the concept of Query Complexity and Rate Limiting in a GraphQL context.

3. Beginner-Friendly Explanation #

Furthermore, if a patient comes in and asks the receptionist to read them the medical records of *every single person in the city*, the receptionist will refuse, because that request is too complex and would take all day. That is Query Complexity Limiting.

4. Real-World Examples #

• Field-Level Authorization: In a company directory, anyone can query a user's name and jobTitle. But only the HR Manager role can query the salary field. GraphQL allows you to secure individual fields, not just the whole object.

• Preventing DoS Attacks: A hacker writes a query: author { posts { author { posts { author { posts } } } } }. Without depth limiting, this will crash the server by infinitely looping the database.

5. Implementing Authorization #

PHP Code Example:

'deletePost' => [
    'type' => Type::boolean(),
    'args' => ['id' => Type::nonNull(Type::id())],
    'resolve' => function ($root, $args, $context) {
        $user = $context['user'];
        
        // 1. Are they logged in?
        if (!$user) throw new Exception("Not authenticated");
        
        $post = fetchPostFromDB($args['id']);
        
        // 2. Are they AUTHORIZED to delete this specific post?
        // (Must be an Admin, OR the author of the post)
        if ($user['role'] !== 'ADMIN' && $user['id'] !== $post['author_id']) {
            throw new Exception("You do not have permission to delete this post.");
        }
        
        // 3. Execute logic
        return deletePostFromDB($args['id']);
    }
]

6. Field-Level Security #

// Inside the User Object definition
'socialSecurityNumber' => [
    'type' => Type::string(),
    'resolve' => function ($userRoot, $args, $context) {
        // Only return the SSN if the logged in user is looking at their OWN profile
        if ($context['user']['id'] === $userRoot['id']) {
            return $userRoot['ssn'];
        }
        return null; // Or throw an error
    }
]

7. Query Depth Limiting #

In webonyx/graphql-php:

use GraphQL\Validator\Rules\QueryDepth;
use GraphQL\Validator\DocumentValidator;

// Limit maximum nesting to 5 levels deep
$rule = new QueryDepth(5);
DocumentValidator::addRule($rule);

8. Query Complexity Limiting #

9. Best Practices #

• Delegate Authorization: Don't write 50 lines of permission checks inside the resolver. Pass the request to a dedicated Policy class (e.g., $postPolicy->canDelete($user, $post)).

• Disable Introspection in Production: Introspection is the feature that allows GraphQL Playground to auto-generate documentation by asking the server for its schema. Turn this off in production to prevent attackers from mapping your entire database structure.

• Use Rate Limiting: Implement standard API rate limiting (e.g., 100 requests per minute per IP) at the web-server level (Nginx/Apache) or application middleware.

10. Common Mistakes #

• Putting Auth Logic in the Schema: You cannot handle complex business authorization purely in the Schema SDL. It must be written in the backend resolver logic.

• Trusting Client Input: Never trust an argument like mutation { updateRole(role: "ADMIN") }. The backend must strictly verify if the current user is allowed to execute that mutation.

11. Mini Exercises #

1. 1. If you restrict access to the email field inside a User type, is that Authentication or Authorization?

1. 2. What technique prevents a query like album { tracks { album { tracks { album } } } }?

12. Coding Challenges #

13. MCQs with Answers #

14. Interview Questions #

• Q: Describe how you would secure a specific field inside an object so that only the owner of the object can view it.

• Q: Explain Query Complexity Limiting. How does it differ from Query Depth Limiting?

• Q: Why is it recommended to turn off Schema Introspection in a production environment?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #