Can Dgraph provide unified auth?

[Willem520 (Yu Wei)]

Hi.I know in alpha,I can set “auth_token” param for alter request.but have no auth method for query and mutation.I think it has safety problem.for example,I have a prod env for business. it means if anyone get alpha address,I can do any query and mutation on my data without auth.it is too bad.

[MichelDiz]

I think this is the same case bellow

Graphql interface with auth

This is being analyzed (but I think they are already starting to work on it if I’m not mistaken). Quote from @michaelcompton You can always use the GraphQL as part of another server that has auth built into it, exposing it straight to the world is not the only thing you can do, and till we have auth built-in, it’s not something you should do at all. Don’t expose your DB without adequate security … that’s just bad ACL works in GraphQL, just like normal In general, following the specif…

@Willem520

no auth method for query and mutation

This is probably a case for ACL.