How do you handle authentication and authorization in a GraphQL API?

Expected Interview Answer

Step-by-Step Explanation

1. Step 1

   Authenticate at the edge

   In HTTP middleware or the context function, read the token/cookie, verify it, and reject or continue.

2. Step 2

   Populate context

   Decode the verified token and attach the user (or null) to the GraphQL context so every resolver can read context.user.

3. Step 3

   Enforce authorization per field

   In resolvers, directives, or middleware, check the user's roles/ownership against the field or record before returning data.

4. Step 4

   Centralize reusable rules

   Extract common checks into schema directives (e.g., @auth(requires: ADMIN)) or resolver wrappers to avoid duplication.

5. Step 5

   Fail safely

   Throw a typed error (or return null) for denied fields, and never leak existence or data through error messages.

6. Step 6

   Guard mutations and nested objects

   Apply the same checks to mutations and to nested object resolvers, since one query can traverse many types.

Code Example

// 1. AUTHENTICATION: verify the token once and attach the user to context
const context = async ({ req }) => {
  const token = (req.headers.authorization || '').replace('Bearer ', '');
  let user = null;
  if (token) {
    try {
      user = jwt.verify(token, process.env.JWT_SECRET); // { id, roles }
    } catch {
      user = null; // invalid token -> treated as unauthenticated
    }
  }
  return { user };
};

// 2. AUTHORIZATION: check permissions per field/record
const resolvers = {
  Query: {
    adminReport: (_p, _a, { user }) => {
      if (!user) throw new GraphQLError('Not authenticated');
      if (!user.roles.includes('ADMIN'))
        throw new GraphQLError('Forbidden');
      return getReport();
    },
    myOrders: (_p, _a, { user }) => {
      if (!user) throw new GraphQLError('Not authenticated');
      return db.orders.byUser(user.id); // ownership-scoped
    },
  },
};

directive @auth(requires: Role = USER) on FIELD_DEFINITION

enum Role { USER ADMIN }

type Query {
  publicStats: Stats
  adminReport: Report @auth(requires: ADMIN)
}

Follow-up Questions

• Why should authorization be enforced per field rather than only at the endpoint?
• How do schema directives like @auth reduce repeated permission checks?
• Where should token verification live — resolvers or the context function, and why?
• How do you prevent authorization checks from leaking record existence?
• How does authorization differ for mutations versus queries?