Context-based authentication in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of context-based authentication in GraphQL?

Imagine you have a GraphQL API that needs to allow users to access data only if they are logged in and have the right permissions. What is the main role of context-based authentication in this scenario?

A It stores user information and permissions during a request to control access to data.

B It automatically encrypts all data sent between client and server.

C It caches query results to speed up repeated requests.

D It validates the syntax of GraphQL queries before execution.

💡 Hint

Think about how the server knows who is making the request and what they are allowed to see.

Context-based authentication in GraphQL means passing user info and permissions in the context object for each request. This helps resolvers decide if the user can access certain data.

❓ query_result

intermediate

What will this GraphQL resolver return with context-based authentication?

Given this resolver snippet, what will be the output if the user is not authenticated?

GraphQL

const resolver = (parent, args, context) => {
  if (!context.user) {
    return 'Access denied';
  }
  return 'Welcome ' + context.user.name;
};

// context = {} (no user key)

A "Welcome undefined"

B null

C "Access denied"

D Error: Cannot read property 'name' of undefined

💡 Hint

Check what happens when context.user is missing.

The resolver checks if context.user exists. If not, it returns 'Access denied'. Since the context has no user, it returns that message.

📝 Syntax

advanced

Identify the syntax error in this GraphQL context setup code

Which option correctly fixes the syntax error in this GraphQL server context function?

GraphQL

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: ({ req }) => {
    const token = req.headers.authorization;
    if (!token) {
      throw new Error('No token');
    }
    const user = getUserFromToken(token);
    return { user };
  }
});

A Wrap the context function body in curly braces and add a return statement.

B Add a comma after 'req.headers.authorization' to separate statements.

C Add a semicolon after each statement inside the context function.

D No syntax error; the code is correct as is.

💡 Hint

Check if the arrow function syntax and object return are valid.

The context function uses concise arrow function syntax returning an object. The code is syntactically correct.

❓ optimization

advanced

How to optimize context-based authentication for performance?

You want to avoid decoding the user token multiple times in nested resolvers. Which approach optimizes context-based authentication?

A Decode the token in every resolver that needs user info.

B Decode the token once in the context function and pass the user info down to all resolvers.

C Store the token in a global variable accessible by all resolvers.

D Skip token decoding and trust client-provided user info.

💡 Hint

Think about doing work once per request instead of multiple times.

Decoding the token once in the context function is efficient. It avoids repeated work and ensures consistent user info for all resolvers.

🔧 Debug

expert

Why does this GraphQL query fail with 'Cannot read property of undefined' error?

Consider this resolver code snippet:

const resolver = (parent, args, context) => {
  if (context.user.role !== 'admin') {
    throw new Error('Unauthorized');
  }
  return 'Secret data';
};

// context = {} (empty object)

Why does this code cause an error?

A Because <code>context.user</code> is undefined, so accessing <code>role</code> causes an error.

B Because the resolver is missing a return statement for unauthorized users.

C Because the <code>context</code> object should not be empty; it must be null.

D Because the error message is misspelled.

💡 Hint

Check what happens when you try to access a property of something that does not exist.

Accessing context.user.role when context.user is undefined causes a runtime error. The code should first check if context.user exists.