A toolset for authorizing access to graph types for GraphQL.NET.
Provides the following packages:
| Package | Downloads | NuGet Latest |
|---|---|---|
| GraphQL.Authorization |  |  |
You can get all preview versions from GitHub Packages. Note that GitHub requires authentication to consume the feed. See here.
AddAuthorization on the provided IGraphQLBuilder inside AddGraphQL extension method.ClaimsPrincipal through ExecutionOptions.User.AuthorizationSettings.IProvideMetadata:
AuthorizeWithPolicy(string policy) extension methodAuthorizeAttribute attribute if using Schema + Handler syntax.AuthorizationValidationRule will run and verify the policies based on the registered policies.IAuthorizationRequirement.@skip and @include directives are ignored; all selected fields of the selected operation will
be checked for authentication requirements, including referenced fragments. (Other operations
in the same document will correctly be skipped.)
This authorization framework only supports policy-based authorization. It does not support role-based authorization, or the
[AllowAnonymous] attribute/extension, or the [Authorize] attribute/extension indicating authorization is required
but without specifying a policy. It also does not integrate with ASP.NET Core's authorization framework.
The GraphQL.Server repository contains an authorization rule which has the above missing features, intended for use with ASP.NET Core. It may also be tailored with custom authentication code if desired, rather than relying on ASP.NET Core's authentication framework.
Fully functional basic Console sample.
Fully functional ASP.NET Core sample.
GraphType first syntax - use AuthorizeWithPolicy extension method on IGraphType or IFieldType.
public class MyType : ObjectGraphType
{
public MyType()
{
this.AuthorizeWithPolicy("AdminPolicy");
Field<StringGraphType>("name").AuthorizeWithPolicy("SomePolicy");
}
}AuthorizeAttribute attribute on type, method or property.[Authorize("MyPolicy")]
public class MutationType
{
[Authorize("AnotherPolicy")]
public async Task<string> CreateSomething(MyInput input)
{
return await SomeMethodAsync(input);
}
[Authorize("SuperPolicy")]
public string SomeProperty => Guid.NewGuid().ToString();
}