I have a use case where I want a subset of my queries and mutations to require authent

Awesome, thanks <a class="user-mention notranslate" data-hovercard-type="user" data-ho

Require authentication with JWT for only a subset of queries and mutations about authorization HOT 3 CLOSED

okarlsson commented on July 18, 2024

Require authentication with JWT for only a subset of queries and mutations

from authorization.

Comments (3)

okarlsson commented on July 18, 2024

So I've researched this some more and it seems like I can get away without using the [Authorize] attribute on my endpoint. The UserContext gets populated from the JWT token without the attribute.

This means that I could solve this by making sure that my users always have a role in the JWT token.

So I can register some policies like this:

services.AddGraphQLAuth({
    _.AddPolicy("UserPolicy", p => p.RequireClaim("roles", "user", "admin"));
    _.AddPolicy("AdminPolicy", p => p.RequireClaim("roles", "admin"));
});

And then use them on my fields like this:

// Mutation open for anyone
graphQLMutation.FieldAsync<ResponseGraphType<StringGraphType>>(
	"doSomething",
	arguments: new QueryArguments(
		new QueryArgument<NonNullGraphType<StringGraphType>> { Name = "username" }
	),
	resolve: async context =>
	{
		// Do something..
	}
);

// Mutation open for users and admins
graphQLMutation.FieldAsync<ResponseGraphType<StringGraphType>>(
	"doSomethingAsUser",
	arguments: new QueryArguments(
		new QueryArgument<NonNullGraphType<StringGraphType>> { Name = "username" }
	),
	resolve: async context =>
	{
		// Do something as user..
	}
).AuthorizeWith("UserPolicy");

// Mutation open for admins
graphQLMutation.FieldAsync<ResponseGraphType<StringGraphType>>(
	"doSomethingAsAdmin",
	arguments: new QueryArguments(
		new QueryArgument<NonNullGraphType<StringGraphType>> { Name = "username" }
	),
	resolve: async context =>
	{
		// Do something as admin..
	}
).AuthorizeWith("AdminPolicy");

Could there be any potential security risks here?

from authorization.