Context-based authentication in GraphQL

Introduction

Context-based authentication helps check who you are before giving access to data. It keeps data safe by using information about the user or request.

When you want to allow only logged-in users to see their own data.

When you need to check user roles before allowing certain actions.

When you want to track who made a request for auditing.

When you want to customize data shown based on user location or device.

When you want to protect sensitive data from unauthorized access.

Syntax

GraphQL

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: ({ req }) => {
    // Extract user info from request headers
    const user = getUserFromToken(req.headers.authorization);
    return { user };
  }
});

The context function runs for every request and can add user info.

You can use the context inside resolvers to check user identity or permissions.

Examples

Extracts user info from the request header token and adds it to context.

GraphQL

context: ({ req }) => {
  const user = getUserFromToken(req.headers.authorization);
  return { user };
}

Sets a fixed user in context for testing or development.

GraphQL

context: () => ({
  user: { id: '123', role: 'admin' }
})

Adds the request IP address to context for logging or restrictions.

GraphQL

context: ({ req }) => {
  const ip = req.ip;
  return { ip };
}

Sample Program

This GraphQL server checks the user's token from the request header. Only users with the 'admin' role can get the secret data. Others get errors.

GraphQL

const { ApolloServer, gql } = require('apollo-server');

const typeDefs = gql`
  type Query {
    secretData: String
  }
`;

const resolvers = {
  Query: {
    secretData: (parent, args, context) => {
      if (!context.user) {
        throw new Error('Not authenticated');
      }
      if (context.user.role !== 'admin') {
        throw new Error('Not authorized');
      }
      return 'Top secret info';
    }
  }
};

function getUserFromToken(token) {
  if (token === 'admin-token') {
    return { id: '1', role: 'admin' };
  } else if (token === 'user-token') {
    return { id: '2', role: 'user' };
  }
  return null;
}

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: ({ req }) => {
    const token = req.headers.authorization || '';
    const user = getUserFromToken(token);
    return { user };
  }
});

server.listen().then(({ url }) => {
  console.log(`Server ready at ${url}`);
});

Important Notes

Always validate tokens carefully to avoid security risks.

Context runs for every request, so keep it fast and simple.

You can add more info to context like user permissions or request details.

Summary

Context-based authentication uses request info to check user identity.

It helps protect data by allowing only authorized users to access it.

Use the context function to add user info for resolvers to check.

Practice

1. What is the main purpose of context-based authentication in GraphQL?

easy

A. To cache query results

B. To verify user identity using request information

C. To format the response data

D. To speed up query execution

Solution

1. Step 1: Understand context-based authentication

   It uses information from the request, like tokens, to verify who the user is.

2. Step 2: Identify the main goal

   The goal is to check user identity to allow or deny access to data.

3. Final Answer:

   To verify user identity using request information -> Option B

4. Quick Check:

   Context-based authentication = verify user identity [OK]

Hint: Context holds user info to check identity quickly [OK]

Common Mistakes:

• Thinking it speeds up queries
• Confusing with data formatting
• Assuming it caches results

2. Which of the following is the correct way to add user info to the GraphQL context in a server setup?

easy

A. context: ({ req }) => ({ user: req.user })

B. context: (user) => ({ req: user })

C. context: () => ({ user: 'anonymous' })

D. context: ({ res }) => ({ user: res.user })

Solution

1. Step 1: Identify how context receives request info

   Context function receives an object with request (req) and response (res).

2. Step 2: Correctly extract user from request

   User info is usually attached to req, so context: ({ req }) => ({ user: req.user }) is correct.

3. Final Answer:

   context: ({ req }) => ({ user: req.user }) -> Option A

4. Quick Check:

   Context uses req.user = context: ({ req }) => ({ user: req.user }) [OK]

Hint: Context function gets req, extract user from req.user [OK]

Common Mistakes:

• Using res instead of req
• Passing user as argument instead of req
• Setting static user instead of dynamic

3. Given this resolver snippet, what will be the output if context.user is { id: 5, role: 'admin' }?

resolve(parent, args, context) {
  if (context.user?.role === 'admin') {
    return 'Access granted';
  } else {
    return 'Access denied';
  }
}

medium

A. 'Access denied'

B. null

C. 'Access granted'

D. Error: Cannot read property 'role' of undefined

Solution

1. Step 1: Check user role in context

   The code checks if context.user.role equals 'admin'. Given context.user.role is 'admin', condition is true.

2. Step 2: Determine returned string

   Since condition is true, the resolver returns 'Access granted'.

3. Final Answer:

   'Access granted' -> Option C

4. Quick Check:

   context.user.role === 'admin' -> 'Access granted' [OK]

Hint: Check user role in context to decide access [OK]

Common Mistakes:

• Ignoring optional chaining and assuming error
• Confusing role values
• Assuming null return

4. Identify the error in this context setup code:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: (req) => {
    const user = authenticate(req.headers.authorization);
    return { user };
  }
});

medium

A. The context function should destructure req as ({ req })

B. authenticate function is missing

C. context function should return user directly, not an object

D. Authorization header should be accessed as req.authorization

Solution

1. Step 1: Check context function parameter

   ApolloServer passes an object with req property, so context should destructure it as ({ req }).

2. Step 2: Identify correct usage of authorization header

   Authorization header is accessed via req.headers.authorization, so destructuring is needed.

3. Final Answer:

   The context function should destructure req as ({ req }) -> Option A

4. Quick Check:

   Context param = ({ req }) not (req) [OK]

Hint: Destructure req from context param: ({ req }) [OK]

Common Mistakes:

• Using req directly without destructuring
• Assuming authenticate is missing error
• Returning user instead of object

5. You want to restrict a GraphQL query so only the user who owns the data or an admin can access it. Which context-based authentication check correctly enforces this?

resolve(parent, args, context) {
  // args.id is the data owner ID
  // context.user has id and role
  ???
}

hard

A. if (args.id === null) { return 'Allowed'; } else { return 'Denied'; }

B. if (context.user.id !== args.id && context.user.role !== 'admin') { return 'Allowed'; } else { return 'Denied'; }

C. if (context.user.role === 'admin') { return 'Denied'; } else { return 'Allowed'; }

D. if (context.user.id === args.id || context.user.role === 'admin') { return 'Allowed'; } else { return 'Denied'; }

Solution

1. Step 1: Understand access rules

   Access is allowed if user owns data (user.id === args.id) or user is admin (role === 'admin').

2. Step 2: Check condition logic

   if (context.user.id === args.id || context.user.role === 'admin') { return 'Allowed'; } else { return 'Denied'; } correctly uses OR (||) to allow access if either condition is true.

3. Final Answer:

   if (context.user.id === args.id || context.user.role === 'admin') { return 'Allowed'; } else { return 'Denied'; } -> Option D

4. Quick Check:

   Owner or admin -> allow access [OK]

Hint: Use OR to allow owner or admin access [OK]

Common Mistakes:

• Using AND instead of OR
• Denying admins access
• Ignoring user ID check