Directive-based authorization in GraphQL - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is directive-based authorization in GraphQL?

It is a way to control access to parts of a GraphQL schema by using special annotations called directives that check user permissions before resolving fields.

beginner

How do you apply a directive for authorization on a GraphQL field?

You add the directive name with any needed arguments directly beside the field in the schema, for example: email: String @auth(role: "ADMIN").

intermediate

What role does the resolver play in directive-based authorization?

The resolver checks the directive's rules during query execution and either allows the data to be returned or denies access if the user lacks permission.

intermediate

Why use directive-based authorization instead of checking permissions inside resolvers?

Directives keep authorization logic separate and reusable, making the schema cleaner and easier to maintain.

beginner

Name a common directive name used for authorization in GraphQL schemas.

A common directive name is @auth, which often takes arguments like user roles or permissions to check.

What does a directive in GraphQL do for authorization?

A Formats the output data

B Checks user permissions before returning data

C Defines the database schema

D Caches query results

Directives for authorization check if a user has permission to access certain data before the data is returned.

Where do you place an authorization directive in a GraphQL schema?

A On the field or type that needs protection

B Only in the query operation

C In the database configuration

D Inside the client application code

Authorization directives are placed on schema fields or types to control access at the data level.

What happens if a user does not meet the directive's authorization rules?

A The server crashes

B The query runs normally

C The field returns an error or null

D The data is modified

If authorization fails, the server usually returns an error or null for that field to prevent unauthorized access.

Which of these is a benefit of using directive-based authorization?

A Automatically encrypts data

B Increases query execution time

C Removes the need for authentication

D Centralizes access control logic

Directive-based authorization centralizes and simplifies access control in the schema.

What argument might an @auth directive take?

A role

B color

C size

D format

The @auth directive often takes a 'role' argument to specify which user roles can access the field.

Explain how directive-based authorization works in a GraphQL schema.

Think about how special tags in the schema control who can see data.

Describe the advantages of using directive-based authorization compared to putting authorization checks inside resolvers.

Consider how keeping code organized helps when your app grows.