Putting it All Together - Dgraph Authentication, Authorization, and Granular Access Control (PART 2) - Dgraph Blog

[jdgamble555 (Jonathan Gamble)]

It seems that it actually does secure the nested objects:

@elhil

In short, if I have an @auth rule that forbids me access to Post, it works. But if I then query Author.posts, I can access the post. I would assume that each level of a nested query would need to respect auth rules, else we just can’t nest objects that have auth rules…

@amaster507

This is not true, and I have auth rules and examples in use to backup my statement that this is not true. If you can provide a schema/rules/data/token to prove your point then you have found a security bug and it needs to be fixed. In my schema I have:

See here

J