Context-based authentication in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of context-based authentication in GraphQL?

Imagine you have a GraphQL API that needs to allow users to access data only if they are logged in and have the right permissions. What is the main role of context-based authentication in this scenario?

A It stores user information and permissions during a request to control access to data.

B It automatically encrypts all data sent between client and server.

C It caches query results to speed up repeated requests.

D It validates the syntax of GraphQL queries before execution.

💡 Hint

Think about how the server knows who is making the request and what they are allowed to see.

Context-based authentication in GraphQL means passing user info and permissions in the context object for each request. This helps resolvers decide if the user can access certain data.

❓ query_result

intermediate

What will this GraphQL resolver return with context-based authentication?

Given this resolver snippet, what will be the output if the user is not authenticated?

GraphQL

const resolver = (parent, args, context) => {
  if (!context.user) {
    return 'Access denied';
  }
  return 'Welcome ' + context.user.name;
};

// context = {} (no user key)

A "Welcome undefined"

B null

C "Access denied"

D Error: Cannot read property 'name' of undefined

💡 Hint

Check what happens when context.user is missing.

The resolver checks if context.user exists. If not, it returns 'Access denied'. Since the context has no user, it returns that message.

📝 Syntax

advanced

Identify the syntax error in this GraphQL context setup code

Which option correctly fixes the syntax error in this GraphQL server context function?

GraphQL

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: ({ req }) => {
    const token = req.headers.authorization;
    if (!token) {
      throw new Error('No token');
    }
    const user = getUserFromToken(token);
    return { user };
  }
});

A Wrap the context function body in curly braces and add a return statement.

B Add a comma after 'req.headers.authorization' to separate statements.

C Add a semicolon after each statement inside the context function.

D No syntax error; the code is correct as is.

💡 Hint

Check if the arrow function syntax and object return are valid.

The context function uses concise arrow function syntax returning an object. The code is syntactically correct.

❓ optimization

advanced

How to optimize context-based authentication for performance?

You want to avoid decoding the user token multiple times in nested resolvers. Which approach optimizes context-based authentication?

A Decode the token in every resolver that needs user info.

B Decode the token once in the context function and pass the user info down to all resolvers.

C Store the token in a global variable accessible by all resolvers.

D Skip token decoding and trust client-provided user info.

💡 Hint

Think about doing work once per request instead of multiple times.

Decoding the token once in the context function is efficient. It avoids repeated work and ensures consistent user info for all resolvers.

🔧 Debug

expert

Why does this GraphQL query fail with 'Cannot read property of undefined' error?

Consider this resolver code snippet:

const resolver = (parent, args, context) => {
  if (context.user.role !== 'admin') {
    throw new Error('Unauthorized');
  }
  return 'Secret data';
};

// context = {} (empty object)

Why does this code cause an error?

A Because <code>context.user</code> is undefined, so accessing <code>role</code> causes an error.

B Because the resolver is missing a return statement for unauthorized users.

C Because the <code>context</code> object should not be empty; it must be null.

D Because the error message is misspelled.

💡 Hint

Check what happens when you try to access a property of something that does not exist.

Accessing context.user.role when context.user is undefined causes a runtime error. The code should first check if context.user exists.

Practice

1. What is the main purpose of context-based authentication in GraphQL?

easy

A. To cache query results

B. To verify user identity using request information

C. To format the response data

D. To speed up query execution

Solution

1. Step 1: Understand context-based authentication

   It uses information from the request, like tokens, to verify who the user is.

2. Step 2: Identify the main goal

   The goal is to check user identity to allow or deny access to data.

3. Final Answer:

   To verify user identity using request information -> Option B

4. Quick Check:

   Context-based authentication = verify user identity [OK]

Hint: Context holds user info to check identity quickly [OK]

Common Mistakes:

• Thinking it speeds up queries
• Confusing with data formatting
• Assuming it caches results

2. Which of the following is the correct way to add user info to the GraphQL context in a server setup?

easy

A. context: ({ req }) => ({ user: req.user })

B. context: (user) => ({ req: user })

C. context: () => ({ user: 'anonymous' })

D. context: ({ res }) => ({ user: res.user })

Solution

1. Step 1: Identify how context receives request info

   Context function receives an object with request (req) and response (res).

2. Step 2: Correctly extract user from request

   User info is usually attached to req, so context: ({ req }) => ({ user: req.user }) is correct.

3. Final Answer:

   context: ({ req }) => ({ user: req.user }) -> Option A

4. Quick Check:

   Context uses req.user = context: ({ req }) => ({ user: req.user }) [OK]

Hint: Context function gets req, extract user from req.user [OK]

Common Mistakes:

• Using res instead of req
• Passing user as argument instead of req
• Setting static user instead of dynamic

3. Given this resolver snippet, what will be the output if context.user is { id: 5, role: 'admin' }?

resolve(parent, args, context) {
  if (context.user?.role === 'admin') {
    return 'Access granted';
  } else {
    return 'Access denied';
  }
}

medium

A. 'Access denied'

B. null

C. 'Access granted'

D. Error: Cannot read property 'role' of undefined

Solution

1. Step 1: Check user role in context

   The code checks if context.user.role equals 'admin'. Given context.user.role is 'admin', condition is true.

2. Step 2: Determine returned string

   Since condition is true, the resolver returns 'Access granted'.

3. Final Answer:

   'Access granted' -> Option C

4. Quick Check:

   context.user.role === 'admin' -> 'Access granted' [OK]

Hint: Check user role in context to decide access [OK]

Common Mistakes:

• Ignoring optional chaining and assuming error
• Confusing role values
• Assuming null return

4. Identify the error in this context setup code:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: (req) => {
    const user = authenticate(req.headers.authorization);
    return { user };
  }
});

medium

A. The context function should destructure req as ({ req })

B. authenticate function is missing

C. context function should return user directly, not an object

D. Authorization header should be accessed as req.authorization

Solution

1. Step 1: Check context function parameter

   ApolloServer passes an object with req property, so context should destructure it as ({ req }).

2. Step 2: Identify correct usage of authorization header

   Authorization header is accessed via req.headers.authorization, so destructuring is needed.

3. Final Answer:

   The context function should destructure req as ({ req }) -> Option A

4. Quick Check:

   Context param = ({ req }) not (req) [OK]

Hint: Destructure req from context param: ({ req }) [OK]

Common Mistakes:

• Using req directly without destructuring
• Assuming authenticate is missing error
• Returning user instead of object

5. You want to restrict a GraphQL query so only the user who owns the data or an admin can access it. Which context-based authentication check correctly enforces this?

resolve(parent, args, context) {
  // args.id is the data owner ID
  // context.user has id and role
  ???
}

hard

A. if (args.id === null) { return 'Allowed'; } else { return 'Denied'; }

B. if (context.user.id !== args.id && context.user.role !== 'admin') { return 'Allowed'; } else { return 'Denied'; }

C. if (context.user.role === 'admin') { return 'Denied'; } else { return 'Allowed'; }

D. if (context.user.id === args.id || context.user.role === 'admin') { return 'Allowed'; } else { return 'Denied'; }

Solution

1. Step 1: Understand access rules

   Access is allowed if user owns data (user.id === args.id) or user is admin (role === 'admin').

2. Step 2: Check condition logic

   if (context.user.id === args.id || context.user.role === 'admin') { return 'Allowed'; } else { return 'Denied'; } correctly uses OR (||) to allow access if either condition is true.

3. Final Answer:

   if (context.user.id === args.id || context.user.role === 'admin') { return 'Allowed'; } else { return 'Denied'; } -> Option D

4. Quick Check:

   Owner or admin -> allow access [OK]

Hint: Use OR to allow owner or admin access [OK]

Common Mistakes:

• Using AND instead of OR
• Denying admins access
• Ignoring user ID check