# Sam Julien - Becoming a “Secret” Agent: Securing Your GraphQL Backend with JWTs **URL:** \ **Category:** GraphQL in Space Conference\ **Tags:** 2020\ **Created:** [September 3, 2020, 4:26pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007 "2020-09-03T16:26:27Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![phoebe](https://avatars.discourse-cdn.com/v4/letter/p/41988e/32.png) [@phoebe](https://discuss.dgraph.io/u/phoebe)\ **Post date:** [September 3, 2020, 4:26pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/1 "2020-09-03T16:26:27Z")
[![](https://canada1.discourse-cdn.com/flex007/uploads/dgraph/original/2X/5/53c39871fd446fc1daa27b37151215b1de0fa8c9.jpeg "Becoming a “Secret” Agent: Securing Your GraphQL Backend w/JWTs | Sam Julien | GraphQL in Space 2020") ](https://www.youtube.com/watch?v=p29Biefs-RA) ### About Sam Hi, I’m Sam, an Angular GDE and Collaborator, a Sr. Developer Advocate Engineer at Auth0, and the creator of [UpgradingAngularJS.com](http://UpgradingAngularJS.com) and GetAJobIn.Tech. I’m also an author for [Thinkster.io](http://Thinkster.io) and egghead. My favorite thing in the world is sitting outside drinking good scotch next to a fire I built myself. ### _Becoming a “Secret” Agent: Securing Your GraphQL Backend with JWTs_ Are you confused about how authentication and authorization relate to GraphQL APIs? You’re not alone! It’s no secret that learning auth is hard on its own, let alone on top of GraphQL. In this talk, Sam will show how to demystify auth while learning how to use JSON Web Tokens (JWTs) with GraphQL APIs! After discovering why controlling access to APIs is so challenging and ways that can be used to solve it, Sam will step through how to handle authorization in the GraphQL server. This talk will use JavaScript examples, but the principles will apply to other tech. By the end, you’ll feel a whole lot better about tackling auth in GraphQL! ### Have questions for Sam? Submit them below. Sam would love to answer them! ### Haven’t signed up for the free conference yet? Grab your free tickets here: [https://graphqlcon.space](https://graphqlcon.space) ### Follow Sam GitHub: [samjulien (Sam Julien) · GitHub](https://github.com/samjulien) Twitter: [https://twitter.com/samjulien](https://twitter.com/samjulien) LinkedIn: [https://www.linkedin.com/in/samjulien/](https://www.linkedin.com/in/samjulien/) ---
**Author:** ![chewxy](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/chewxy/32/4339_2.png) [@chewxy](https://discuss.dgraph.io/u/chewxy)\ **Post date:** [September 10, 2020, 1:12am UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/2 "2020-09-10T01:12:33Z")
Asking on behalf of @gotjoshua: Do you know how to work with JWE (encrypted version of JWT) ---
**Author:** ![gotjoshua](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gotjoshua/32/4150_2.png) [@gotjoshua](https://discuss.dgraph.io/u/gotjoshua)\ **Post date:** [September 10, 2020, 2:09pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/3 "2020-09-10T14:09:26Z")
> [@chewxy](#): > > on behalf of Here is an ongoing thread: > [@@auth - JWT in JWE format - can dgraph handle it?](http://discuss.hypermode.com/t/auth-jwt-in-jwe-format-can-dgraph-handle-it/10148/6): > > After more thinking, I am considering a strategy like this: My backed component: gets a valid Oauth token for a user creates a JWE that includes claims: { ip: x.x.x.x, userID: ###, sessionID: ### } // this payload would be signed and encrypted with a key // that only dgraph and the backend know the backend needs to update the user-\>sessionID edge with a facet for the (ip=x.x.x.x) this JWE can be stored by the client and used to authenticate queries and mutations via dgraph-js-http… ---
**Author:** ![ymekuria](https://avatars.discourse-cdn.com/v4/letter/y/13edae/32.png) [@ymekuria](https://discuss.dgraph.io/u/ymekuria)\ **Post date:** [September 10, 2020, 3:50pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/4 "2020-09-10T15:50:15Z")
Hi Sam. Do you have an advice/resources/best practices for integrating auth0 with a react native mobile app using expo? The stack for project I’m working on is react native/expo, graphql/apollo client on the client with node/express graphql/apollo server, and prisma/postgress on the backend. From what I gather, I would have to eject from expo to to use the react-native-auth0 module from this guide [Auth0 React Native SDK Quickstarts: Login](https://auth0.com/docs/quickstart/native/react-native/00-login). Do you have any resources or know any approaches others have used to integrate auth0 into a react native/expo project without ejecting from expo? ---
**Author:** ![conor](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@conor](https://discuss.dgraph.io/u/conor)\ **Post date:** [September 10, 2020, 4:45pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/5 "2020-09-10T16:45:27Z")
Most server-side authorization implementations I have seen involve checking permissions from the JWT’s `scopes` at the start of each type-resolver function. This means – for example – that a query may execute multiple database queries before reaching a nested resolver that fails a permissions check. Besides resulting in a poor user experience for big/deep queries that take longer, this scenario would also waste slash-graphql query credits. Are there recommended ways to verify all permissions on all resolvers related to the query before query execution to avoid unnecessary computation time? The best I can think of is adding middleware that will do a traversal of the query AST to check permissions required by each resolver before invoking the root resolver(s). ---
**Author:** ![Jay](https://avatars.discourse-cdn.com/v4/letter/j/ed8c4c/32.png) [@Jay](https://discuss.dgraph.io/u/Jay)\ **Post date:** [September 10, 2020, 6:40pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/6 "2020-09-10T18:40:09Z")
Is it good practice to make GraphQL proxy server over REST api provider just to hide REST endpoints? Or will it be waste of resources? Just in case i don’t want to expose my REST endpoints to frontend? ---
**Author:** ![Nikunj-Aggarwal](https://avatars.discourse-cdn.com/v4/letter/n/e480ec/32.png) [@Nikunj-Aggarwal](https://discuss.dgraph.io/u/Nikunj-Aggarwal)\ **Post date:** [September 10, 2020, 6:41pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/7 "2020-09-10T18:41:15Z")
Can you explain the different types of tokens and how are they different? Which one is best? The token changes in a period then how does that part work? ---
**Author:** ![varunvs](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/varunvs/32/3725_2.png) [@varunvs](https://discuss.dgraph.io/u/varunvs)\ **Post date:** [September 10, 2020, 6:44pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/8 "2020-09-10T18:44:54Z")
What would you recommend for authorisation in case there is a case for granular permissions model instead of roles? Won’t storing entire permissions in the JWT token a bad idea due to large size/limitations? Also, when a permission/role is changed how can we force change the token to reflect latest updates? ---
**Author:** ![freeGraph](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/freegraph/32/4692_2.png) [@freeGraph](https://discuss.dgraph.io/u/freeGraph)\ **Post date:** [September 10, 2020, 7:13pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/9 "2020-09-10T19:13:07Z")
This was a great talk, I particularly enjoyed the intro to Auth/JWT during the first few minutes. It seems with Slash Dgraph, many of the things discussed later in the talk have been handled for you. This recent blog post is great: [A Match Made In Heaven: Authentication and Authorization with Dgraph and Auth0 - Dgraph Blog](https://dgraph.io/blog/post/slash-auth0-dgraph/) And so is this video: [Serverless GraphQL Authentication + Authorization Using Dgraph & Auth0 - Webinar Replay - YouTube](https://www.youtube.com/watch?v=CUc7txIy5AE) ---
**Author:** ![thiyaga](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/thiyaga/32/4747_2.png) [@thiyaga](https://discuss.dgraph.io/u/thiyaga)\ **Post date:** [September 10, 2020, 7:57pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/10 "2020-09-10T19:57:49Z")
What is your one-liner to explain the difference between authentication & authorization? ---
**Author:** ![WoutB](https://avatars.discourse-cdn.com/v4/letter/w/b9e5f3/32.png) [@WoutB](https://discuss.dgraph.io/u/WoutB)\ **Post date:** [September 10, 2020, 9:59pm UTC](https://discuss.dgraph.io/t/sam-julien-becoming-a-secret-agent-securing-your-graphql-backend-with-jwts/10007/11 "2020-09-10T21:59:34Z")
Question to all: what’s your favorite app to play with api’s?