Context-based authentication in GraphQL - Step-by-Step Execution

Concept Flow - Context-based authentication

User sends GraphQL request

↓

Extract user context (IP, device, location)

↓

Check context against rules

↓

Allow access

↓

Return response or error

The flow shows how a GraphQL request is checked using user context like IP or device to decide access.

Execution Sample

GraphQL

query getUserData {
  user(id: "123") {
    name
    email
  }
}

A GraphQL query requesting user name and email, which triggers context-based authentication checks.

Execution Table

Step	Action	Context Extracted	Rule Check Result	Access Decision	Response
1	Receive GraphQL query	N/A	N/A	N/A	Waiting
2	Extract context from request	IP=192.168.1.10, Device=Mobile	N/A	N/A	Waiting
3	Check if IP is trusted	IP=192.168.1.10	Yes	Allow	Proceed
4	Check if device is recognized	Device=Mobile	Yes	Allow	Proceed
5	Return user data	N/A	N/A	Allow	{ user: { name: "Alice", email: "[e-mail]" } }
6	End	N/A	N/A	N/A	Completed

💡 Access allowed after context checks pass, user data returned.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
IP	N/A	192.168.1.10	192.168.1.10	192.168.1.10	192.168.1.10
Device	N/A	Mobile	Mobile	Mobile	Mobile
AccessDecision	N/A	N/A	Allow	Allow	Allow
Response	N/A	N/A	N/A	N/A	{ user: { name: "Alice", email: "[e-mail]" } }

Key Moments - 2 Insights

Why do we extract context before checking rules?

Context like IP and device must be known first to apply rules correctly, as shown in steps 2 and 3 of the execution_table.

What happens if the IP is not trusted?

If IP check fails (step 3), access would be denied or extra verification requested, stopping the flow before returning data.

Visual Quiz - 3 Questions

Look at the execution_table, what is the Access Decision at step 3?

A Allow

B Deny

C Pending

D Error

💡 Hint

Check the 'Access Decision' column at step 3 in the execution_table.

At which step is the user data returned in the response?

A Step 2

B Step 5

C Step 4

D Step 6

💡 Hint

Look at the 'Response' column to find when user data is sent back.

If the device was unrecognized, how would the Access Decision change at step 4?

A Pending

B Allow

C Deny or request 2FA

D No change

💡 Hint

Refer to the concept_flow where 'No' branch leads to denial or extra verification.

Concept Snapshot

Context-based authentication in GraphQL:
- Extract user context (IP, device, location) from request
- Check context against security rules
- Allow or deny access based on checks
- Return data only if context is trusted
- Helps secure APIs by adapting to user environment

Full Transcript

Context-based authentication in GraphQL means checking details like IP address and device type when a user sends a query. The system first extracts this context, then compares it to trusted rules. If the context matches trusted values, access is allowed and the requested data is returned. If not, access is denied or extra verification is requested. This process helps keep data safe by making sure only trusted users and devices get access.