Server-side Authentication in GraphQL

The workshop focuses on GraphQL authentication and authorization, including different kinds of authorizations, how to use GraphQL together, and practical exercises involving JSON Web Tokens (JWT) for authentication.

The workshop is led by Roy, who is currently a manager for the engineering teams at Vandebron, a Dutch renewable energy company.

Participants need to have Node.js running on their machines and an editor at hand to work on the exercises.

Exercises for the workshop are available on GitHub. Roy will share the link after the first part of the workshop.

A JSON Web Token (JWT) is a way to share encrypted information between a client and a server. It consists of a header, payload, and signature, and is used for authentication purposes.

Authentication in a GraphQL server can be implemented using resolver-level authentication, context-level authentication, or schema-based authentication with custom directives.

The context in GraphQL authentication is used to pass information like HTTP headers, including JWTs, to the resolvers. It acts as a shared space to manage authentication details across different parts of the server.

The OAuth flow involves passing tokens between a client and a server for authentication. The client sends a username and password to the server, which then returns a JWT. This token is used for subsequent requests to access private data.

JWTs can be validated in a GraphQL server by using libraries like JSON Web Token. The token's validity is checked using a secret key, and if valid, the server grants access to the requested resources.

Schema-based authentication with custom directives is beneficial because it makes the authentication requirements clear directly in the schema. This approach is more declarative and reduces the need for additional documentation.