Authorization in GraphQL: Peanut Butter and Chocolate
summary
A small Python + Strawberry GraphQL app uses a middleware that inspects the schema and query to infer required checks, prefetches permission data, batches authorization into a single authorization request to Oso, and filters or nulls fields (demo shows repo1 losing collaborators and repo2 hidden). The system reduces N+1 DB permission lookups by planning ahead, supports schema annotations like field-level directives, and proves effective in the live demo with minimal code changes and predictable performance.
AI-written summary · about
chapters (8)
- 0:00Introduction and demo
- 2:11Why authorization is hard
- 5:44Challenges in GraphQL authorization
- 8:53Magic one authorization approach
- 14:10Apollo’s authorization features
- 15:57Handling list endpoints
- 19:28Is this approach better?
- 21:12Feedback and next steps
related talks
27mAuthorization in the GraphQL era
51mAPI Security: Securing GraphQL without going around in circles
40mAuthentication and Authorization in GraphQL
25mThe Root of Auth Thingz
45mStrawberry Fields Forever: Enjoy building GraphQL Web APIs
51mAuthorization beyond @RolesAllowed
17mDesign Complex Authorization with Ory Keto
30mREST & GraphQL: Adventures in schema-first API development