GraphQL websocket security about siler HOT 5 CLOSED

Awesome question. GraphQL as-is does not specify any kind of authentication and/or authorization mechanisms (even something like Subscriptions, its a RFC yet), there this is delegated to client/server implementations. Apollo's client and server websocket transports layer agrees on a connectionParams payload over connection initialization: https://www.apollographql.com/docs/graphql-subscriptions/authentication.html Where your cliente can send a token and your server can hook a callback to intercept it.

from siler.

Since Siler lacks of something like hooks to accomplish a similar behavior, I'll be promoting this issue to a enhancement for v1.1. For now the workaround would be allow a connection and restricting data thought filters and/or resolvers.

from siler.

So, the work around will be send the token as a variable and then validate it like the roomName filter, isn't?

from siler.

Exactly, you can send user's token as a variable, like roomName, then authenticate and authorize it thought filters. Unfortunately, this workaround would not prevent unauthorized users to connect to your server, but allows you to at least restrict your data.

from siler.

Awesome, thanks!

from siler.