Concerns about authentication/authorization in DGraph with GraphQL endpoint

Users Dgraph Cloud
, ,
2

There is two type of auth rules: RBAC and ABAC. ABAC rules are basically GraphQL queries so you can write them independently in some GraphQL client.
Example:

type User @auth(
  delete: { and: [
    { rule: """
    query($USER: String!) {
        queryUser(filter: { username: { eq: $USER } }) {
        __typename
        }
    }
    """ },
    { rule: """
    query {
        queryUser(filter: { isPublic: true }) {
            __typename
        }
    }
    """}]
  }
){
  username: String! @id
  age: Int
  isPublic: Boolean @search
  disabled: Boolean
  tickets: [Ticket] @hasInverse(field: assignedTo)
  secrets: [UserSecret]
  issues: [Issue]
  tweets: [Tweets] @hasInverse(field: user)
}

The rule is basically a GraphQL query:

    query($USER: String!) {
        queryUser(filter: { username: { eq: $USER } }) {
        __typename
        }
    }

We use regex matching to parse RBAC rules so this should be an easy fix.

Having public key in schema doesn’t mean we would block request not having JWT. We block only those requests for types that have auth rules associated with it. Types having no auth rules would still work without the JWT token.

1 Like