JWT integration in GraphQL - Mini Project: Build & Apply

JWT Integration in GraphQL API

📖 Scenario: You are building a simple GraphQL API that requires user authentication using JWT (JSON Web Tokens). This API will allow users to log in and access protected data only if they provide a valid JWT token.

🎯 Goal: Build a GraphQL API with JWT integration that authenticates users and protects a query so only authenticated users can access it.

📋 What You'll Learn

Create a user data structure with username and password

Add a secret key configuration for signing JWT tokens

Implement a login mutation that returns a JWT token

Protect a query by verifying the JWT token from the request

💡 Why This Matters

🌍 Real World

JWT is widely used to secure APIs by ensuring only authenticated users can access protected resources.

💼 Career

Understanding JWT integration is essential for backend developers working with modern web APIs and authentication systems.

1

DATA SETUP: Create a user data structure

Create a dictionary called users with one user entry: username 'alice' and password 'wonderland'.

GraphQL

# Create the users dictionary with username 'alice' and password 'wonderland'
# Your code here

Hint

Use a Python dictionary with the username as the key and password as the value.

2

CONFIGURATION: Add a secret key for JWT

Create a variable called SECRET_KEY and set it to the string 'mysecretkey'.

GraphQL

users = {'alice': 'wonderland'}
# Create a SECRET_KEY variable with value 'mysecretkey'
# Your code here

Hint

This key will be used to sign and verify JWT tokens.

3

CORE LOGIC: Implement login mutation to return JWT token

Write a function called login that takes username and password. If the credentials match the users dictionary, return a JWT token signed with SECRET_KEY containing the username. Use the jwt library's encode method with algorithm 'HS256'.

GraphQL

users = {'alice': 'wonderland'}
SECRET_KEY = 'mysecretkey'
# Define login(username, password) function to return JWT token if credentials match
# Your code here

Hint

Use jwt.encode({'username': username}, SECRET_KEY, algorithm='HS256') to create the token.

4

COMPLETION: Protect a query by verifying JWT token

Write a function called get_protected_data that takes a token string. Decode the token using jwt.decode with SECRET_KEY and algorithm 'HS256'. If decoding succeeds, return the string 'Protected data for {username}' where {username} is from the token payload. If decoding fails, return 'Access denied'.

GraphQL

import jwt

def login(username, password):
    if users.get(username) == password:
        token = jwt.encode({'username': username}, SECRET_KEY, algorithm='HS256')
        return token
    return null

users = {'alice': 'wonderland'}
SECRET_KEY = 'mysecretkey'

# Define get_protected_data(token) to decode JWT and return protected message
# Your code here

Hint

Use a try-except block to catch invalid tokens and return 'Access denied'.

Practice

1. What is the main purpose of using JWT in GraphQL database integration?

easy

A. To store large amounts of data

B. To speed up database queries

C. To verify the user's identity and secure database access

D. To format the GraphQL schema

Solution

1. Step 1: Understand JWT role in security

   JWT (JSON Web Token) is used to confirm who the user is by verifying their identity.

2. Step 2: Connect JWT to database access

   This verification controls who can access or change data in the GraphQL database.

3. Final Answer:

   To verify the user's identity and secure database access -> Option C

4. Quick Check:

   JWT secures access [OK]

Hint: JWT = user identity check for secure access [OK]

Common Mistakes:

• Thinking JWT speeds up queries
• Confusing JWT with data storage
• Assuming JWT changes schema format

2. Which is the correct way to send a JWT token in a GraphQL request header?

easy

A. Token: Authorization <token>

B. Authorization: Token <token>

C. Auth: Bearer <token>

D. Authorization: Bearer <token>

Solution

1. Step 1: Recall standard JWT header format

   The JWT token is sent in the HTTP header named 'Authorization' with the prefix 'Bearer'.

2. Step 2: Match the correct header syntax

   The correct syntax is 'Authorization: Bearer <token>'. Other options use wrong header names or order.

3. Final Answer:

   Authorization: Bearer <token> -> Option D

4. Quick Check:

   JWT header uses Bearer prefix [OK]

Hint: JWT always uses 'Authorization: Bearer <token>' header [OK]

Common Mistakes:

• Using 'Token' instead of 'Bearer'
• Wrong header name like 'Auth'
• Mixing order of 'Token' and 'Authorization'

3. Given this GraphQL resolver snippet using JWT:

const user = verifyToken(context.headers.authorization);
if (!user) return null;
return db.getUserData(user.id);

What happens if the token is invalid or missing?

medium

A. The resolver returns null and no data is fetched

B. The resolver throws a syntax error

C. The resolver returns all user data without restriction

D. The resolver crashes the server

Solution

1. Step 1: Analyze token verification

   The function verifyToken returns null or false if the token is invalid or missing.

2. Step 2: Check resolver behavior on invalid token

   If user is falsy, the resolver returns null, meaning no data is sent back.

3. Final Answer:

   The resolver returns null and no data is fetched -> Option A

4. Quick Check:

   Invalid token leads to null return [OK]

Hint: Invalid token means no user, so resolver returns null [OK]

Common Mistakes:

• Expecting a syntax error on invalid token
• Assuming data is returned without user
• Thinking server crashes on bad token

4. Identify the error in this JWT integration snippet:

const token = context.headers.Authorization;
const user = verifyToken(token);
if (!user) throw new Error('Unauthorized');
return db.getUserData(user.id);

medium

A. verifyToken should be called with context.token, not token

B. Header name should be lowercase 'authorization', not 'Authorization'

C. The error message should be 'Forbidden' instead of 'Unauthorized'

D. db.getUserData should be called before verifying the token

Solution

1. Step 1: Check header name case sensitivity

   HTTP headers in Node.js are usually lowercase, so 'authorization' is correct, not 'Authorization'.

2. Step 2: Confirm token extraction correctness

   Using 'Authorization' may cause token to be undefined, leading to verification failure.

3. Final Answer:

   Header name should be lowercase 'authorization', not 'Authorization' -> Option B

4. Quick Check:

   Header keys are lowercase [OK]

Hint: Use lowercase 'authorization' header key in code [OK]

Common Mistakes:

• Using uppercase header keys in Node.js
• Calling db before verifying user
• Confusing error message types

5. You want to restrict a GraphQL query so only users with role 'admin' can access sensitive data. Which JWT integration approach is best?

hard

A. Verify token, then check if user.role === 'admin' before returning data

B. Return data first, then verify token asynchronously

C. Skip token verification and rely on frontend checks

D. Verify token but ignore user roles for simplicity

Solution

1. Step 1: Understand role-based access control

   To restrict access, verify the token and check the user's role before sending data.

2. Step 2: Evaluate options for security

   Returning data before verification or skipping roles risks exposing sensitive info.

3. Final Answer:

   Verify token, then check if user.role === 'admin' before returning data -> Option A

4. Quick Check:

   Check role after token verification [OK]

Hint: Check user role after verifying JWT token [OK]

Common Mistakes:

• Sending data before verifying user
• Ignoring roles in backend checks
• Trusting frontend for security