[Solved] How can you ensure a delete mutation only deletes if the user has admin rights? — Ans: Add an authorization check in the resolver before deletion | GraphQL

GraphQL - Mutations

How can you ensure a delete mutation only deletes if the user has admin rights?

AInclude user role as an argument in the mutation

BAdd an authorization check in the resolver before deletion

CReturn an error if user role is missing in mutation response

DUse a query instead of mutation to delete

Step-by-Step Solution

Solution:

Step 1: Understand authorization in GraphQL
Authorization is handled in the server resolver logic, not by mutation arguments.
Step 2: Evaluate options
Passing user role as argument is insecure; queries cannot delete; error return is reactive, not preventive.
Final Answer:
Add an authorization check in the resolver before deletion -> Option B
Quick Check:
Authorization logic belongs in resolver code [OK]

Quick Trick: Put authorization checks inside resolver functions [OK]

Common Mistakes:

Master "Mutations" in GraphQL

9 interactive learning modes - each teaches the same concept differently

More GraphQL Quizzes

How can you ensure a delete mutation only deletes if the user has admin rights?