Absinthe Authentication
summary
Adds an authentication plug before Absinthe plug that extracts an Authorization header (often a JWT), decodes it with an upstream plug, and inserts a map like conn.private.absinthe.context with :current_user or a guest/null into the GraphQL context. Resolvers receive that context as their second arg and can pattern-match in resolvers to return public fields, raise an error for unauthorized access, or allow admins to see secrets. Uses per-field auth instead of transport-level status codes.
AI-written summary · about
related talks
40mAuthentication and Authorization in GraphQL
27mAuthorization in the GraphQL era
51mAPI Security: Securing GraphQL without going around in circles
23mAuthorization in GraphQL: Peanut Butter and Chocolate
25mThe Root of Auth Thingz
33mFirst-Class Auth Experience In Frontend Applications
33mGraphQL Exploitation: Secondary Context Attacks and Business Logic
29mKeeping Agents in Check: Apollo MCP Authentication