Supergraph AuthZ Security in Apollo Router with External Co-processing
summary
Enterprise supergraph enforces per-client ABAC at the edge using Apollo Router external co-processing and Open Policy Agent (OPA) with Rego policies; a broker service translates router payloads to OPA, returns accept or deny, and short‑circuits requests so denied operations never hit subgraphs and can return 401 JSON errors. Demo shows field‑level restrictions, operation/type depth, plans for thousands of clients, and current median overhead around 100–200ms latency.
AI-written summary · about
chapters (14)
- 0:00Introduction to authZ in GraphQL
- 1:05Authentication vs authorization
- 3:10Client-based authorization needs
- 4:14Centralized policy manager concept
- 7:48Why externalize policy decisions
- 10:58Policy structure and levels
- 13:26Introducing Open Policy Agent
- 15:29Architecture with external co-processor
- 17:44OPA policy decision process
- 20:15Live demo setup and results
- 21:41Demo walkthrough and queries
- 24:07Future development plans
- 25:51Additional OPA use cases
- 26:12Q&A and resources
related talks
29mKeeping Agents in Check: Apollo MCP Authentication
46mService ownership at scale: new security and observability features
25mThe Invisible Fortress: Embedding Zero-Trust Governance in the Supergraph
29mGraph-Based Authorization: How to Secure Your API With Your Own Graph
08mGraphQL: everything you want in one query
51mAPI Security: Securing GraphQL without going around in circles
40mAgent-Ready Graphs: Engineering the Foundations for Discoverability, Safety, and QoS
40mAuthentication and Authorization in GraphQL