# Using @auth on individual fields?

**URL:** <https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208>\
**Category:** GraphQL\
**Tags:** auth, status:accepted, kind:feature\
**Created:** [June 15, 2020, 2:44pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208 "2020-06-15T14:44:15Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![amaster507](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/amaster507/32/4123_2.png) [@amaster507](https://discuss.dgraph.io/u/amaster507)\
**Post date:** [June 15, 2020, 2:44pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/1 "2020-06-15T14:44:15Z")

</div>

Breaking this into it’s own topic, so here is the context:

> [@Who’s new in June 2020](http://discuss.hypermode.com/t/who-s-new-in-june-2020/7084/25):
>
> Hi, I am Anthony from Oklahoma, USA. I am the developer of a new startup focused on assisting religous organizations. We launched a version of our SAAS Feb 2018, but are in the process of rebranding, refocusing, and rebuilding from the ground up. We have been using GraphQL for a few months now backed by RDS and are getting tired of working around the limitation of a relational database driving a graph presentation of that data. Trying to decide which graph storage engine best fits our needs bet…

> [@Who’s new in June 2020](http://discuss.hypermode.com/t/who-s-new-in-june-2020/7084/26):
>
> Welcome to this community, @amaster507. Have you looked at the auth documents for GraphQL. They provide pretty granular auth. [https://graphql.dgraph.io/authorization/directive](https://graphql.dgraph.io/authorization/directive)

From reading over the [docs on @auth directive](https://graphql.dgraph.io/authorization/directive/) I understand that these directives can restrict access to the nodes themselves by using JWT properties to check for user roles, or matching graph fields against those properties.

Please correct me if I am wrong, but from how I understand it so far: Once a user has access to a node then the user also has access to all of the fields of that node. If I have a node labeled `person` and I want to restrict a specific property on that node such as a SSN, while allowing other properties such as the name and age, there is not a native @auth directive to do that at this time.

I am thinking that there is a way to control access to fields like this if instead of it living as a field it lives as a related node. `query { person { name hasSSN { SSN } } }` I could then control the `hasSSN` type with it’s own @auth directives.

* * *

The following statement from the docs has intrigued me.

> In general, an auth rule should select a field that’s expected to exist at the inner most field, often that’s the `ID` or `@id` field. Auth rules are run in a mode that requires all fields in the rule to find a value in order to succeed. - [The `@auth` directive](https://graphql.dgraph.io/authorization/directive/)

My initial thinking was that the inner fields in a rule would give access to those fields or restrict access to those fields, but that is not the case. If I understand this right this can be used to control access by looking for a field that would only exist if the user has access to the item. Not based upon a value of the field, but solely if it exists or not. If the rule in the example in the docs was changed to look for inner fields `id, text` and a node existed that did not have a text field then those nodes would be inaccessible. I am trying to think if this logic can somehow be used in a way to control access to fields, but I think the limitation I would run into is that this is only used for granting/restricting the whole node and not just the individual fields.

---

<div class="post-metadata">

**Author:** ![JatinDevDG](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jatindevdg/32/3417_2.png) [@JatinDevDG](https://discuss.dgraph.io/u/JatinDevDG)\
**Post date:** [June 16, 2020, 8:19am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/2 "2020-06-16T08:19:46Z")

</div>

Yeah, currently we don’t have auth to control access to individual fields.  
We will try to include it in the 20.11 version.  
All the fields are not required in order to succeed an auth rule, that is required only if you combined them using AND.  
It depends on the rule that you have applied.

---

<div class="post-metadata">

**Author:** ![mrjn](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/mrjn/32/775_2.png) [@mrjn](https://discuss.dgraph.io/u/mrjn)\
**Post date:** [July 21, 2020, 5:46am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/3 "2020-07-21T05:46:05Z")

</div>

I’m trying to expose my backend to the wider-web, and want to disallow others from modifying the data.

type MyType @auth (  
add: { rule: “{$user: { eq: “mrjn” } }”},  
delete: { rule: “{$user: { eq: “mrjn” } }”},  
update: { rule: “{$user: { eq: “mrjn” } }”}  
){  
id: String! @id  
text: String! @search(by: [fulltext])  
postedAt: DateTime @search @auth()  
}

The 3 rules above allow the backend to be secure, so only I can modify the data. But, I also want to hide postedAt from being queried. How do I do that?

---

<div class="post-metadata">

**Author:** ![dimaip](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/dimaip/32/5721_2.png) [@dimaip](https://discuss.dgraph.io/u/dimaip)\
**Post date:** [December 15, 2020, 1:22pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/4 "2020-12-15T13:22:49Z")

</div>

Any update on this?

It’s very hard to build something practical with Dgraph for me without @auth for individual fields…  
E.g. imagine a user directory where some information like an email must not be visible publicly. What’s the recommended workaround currently for such usecases?

---

<div class="post-metadata">

**Author:** ![maaft](https://avatars.discourse-cdn.com/v4/letter/m/4af34b/32.png) [@maaft](https://discuss.dgraph.io/u/maaft)\
**Post date:** [December 16, 2020, 2:15pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/5 "2020-12-16T14:15:34Z")

</div>

You can add do something like;:

```auto
type User {
  privateStuff: PrivateUserInfo!
  publicStuff: PublicUserInfo!
}

type PrivateUserInfo @auth(...) {
   email: String!
}

type PublicUserInfo {
   whatever: String!
}

```

This of course can become very unhandy because you have to maintain several relationships.

---

<div class="post-metadata">

**Author:** ![dimaip](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/dimaip/32/5721_2.png) [@dimaip](https://discuss.dgraph.io/u/dimaip)\
**Post date:** [December 16, 2020, 2:34pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/6 "2020-12-16T14:34:36Z")

</div>

Thanks so much! It looks a bit odd, but I guess that’d do while we are waiting for the support of this feature.

---

<div class="post-metadata">

**Author:** ![CosmicPangolin1](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/cosmicpangolin1/32/3579_2.png) [@CosmicPangolin1](https://discuss.dgraph.io/u/CosmicPangolin1)\
**Post date:** [March 6, 2021, 9:55pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/7 "2021-03-06T21:55:19Z")

</div>

@JatinDevDG @mrjn

Is there a reasonable eta for this one? The last update was ~9 months ago 🙂

---

<div class="post-metadata">

**Author:** ![JatinDevDG](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jatindevdg/32/3417_2.png) [@JatinDevDG](https://discuss.dgraph.io/u/JatinDevDG)\
**Post date:** [March 9, 2021, 7:46am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/10 "2021-03-09T07:46:35Z")

</div>

Hi @CosmicPangolin1 ,this feature will be available in 21.07 release.

---

<div class="post-metadata">

**Author:** ![sambhav-gore](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/sambhav-gore/32/6342_2.png) [@sambhav-gore](https://discuss.dgraph.io/u/sambhav-gore)\
**Post date:** [March 10, 2021, 10:46pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/11 "2021-03-10T22:46:41Z")

</div>

@JatinDevDG what is the estimated date for that release ? Is there a release schedule somewhere?

EDIT: Oh, I get it, I think 21.07 would be July this year right ?  
I was really hoping for this to be coming out in 21.03 release.

---

<div class="post-metadata">

**Author:** ![JatinDevDG](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jatindevdg/32/3417_2.png) [@JatinDevDG](https://discuss.dgraph.io/u/JatinDevDG)\
**Post date:** [March 11, 2021, 6:37am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/12 "2021-03-11T06:37:29Z")

</div>

Hi @sambhav-gore , sorry we had other priority items for 21.03 and not able to include this feature.  
But that is included in our plan for 21.07 and yes,that will be released in July this year. So, you have to wait a bit more for it.

We are following calender versioning , you can read more about it here [Calender versioning] .([Why there would be no Dgraph 2.0: Goodbye Semantic Versioning - Dgraph Blog](https://dgraph.io/blog/post/dgraph-calendar-versioning/))

---

<div class="post-metadata">

**Author:** ![codinghusi](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/codinghusi/32/6573_2.png) [@codinghusi](https://discuss.dgraph.io/u/codinghusi)\
**Post date:** [March 19, 2021, 11:51am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/13 "2021-03-19T11:51:12Z")

</div>

I’d integrate it with a “for” and “without” property like there is the “and” and “or” property in auth(…).  
In there you could define all your fields you want to export or hide and then also the actual rule for those fields.

---

<div class="post-metadata">

**Author:** ![Californian](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/californian/32/8514_2.png) [@Californian](https://discuss.dgraph.io/u/Californian)\
**Post date:** [July 1, 2021, 7:43am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/14 "2021-07-01T07:43:32Z")

</div>

I don’t think dgraph should be advertised as “production-ready” (at least not for publicly-facing front-end use, i.e. the types of use cases given as examples in the docs) without this feature.

We’ve tried using dgraph several times over the past 2 or 3 years for small- to medium-sized projects, and every time there has been a showstopping feature missing for even simple apps – there used to be dozens, and now there are only a couple. Major props on the progress! However, this stands out as something that should be in the MVP of any GraphQL server used to serve external apps (as opposed to internal-only uses gated by a separate authorization layer).

I’m genuinely curious – how does anyone use this in production? Between this issue and the inability to place authorization restrictions on fields post-update (so e.g. users in a blogging app can’t spoof posts as someone else), are there really use cases where security just doesn’t matter at all?

We’re starting a new, more major project and got everything set up with dgraph only to run into this. It’s a big bummer! Not just because of the wasted development time, but also because we really wanted to use dgraph – a graph database fits our data and queries extremely well.

Unfortunately, this means we’re moving back to hasura, yet again. It’s extremely clunky but at least the production-ready software has a means of restricting access to querying and mutating specific fields for different users/roles.

In general, I’d strongly suggest taking a page out of hasura’s book with the way they handle authorization (though obviously not with their nightmarish approach to overall architecture): (a) give people a GUI (this goes for the rest of the schema as well; the inability to use the schema editor GUI with interfaces is rather unfortunate), and (b) encourage role-linked authorization rules (i.e. rules equivalent to `((role === customer) AND (userId === customerId))`). Just to be clear, I’m aware that the latter is very doable with the `@auth` directive (I just didn’t feel like typing out the verbose, backslash-escaped details), but I think guiding users/suggesting it in the docs would be helpful to people who haven’t thought of structuring authorization in that manner.

Cheers, maybe our project won’t continue as long as we’re expecting and we can try dgraph again in a year or two.

---

<div class="post-metadata">

**Author:** ![jerber](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jerber/32/8920_2.png) [@jerber](https://discuss.dgraph.io/u/jerber)\
**Post date:** [October 2, 2021, 3:52pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/15 "2021-10-02T15:52:18Z")

</div>

Hi @JatinDevDG and @mrjn, was this feature released in the latest version? I’m looking to switch over to Dgraph for production and this is a must for us.

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [October 2, 2021, 7:18pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/16 "2021-10-02T19:18:44Z")

</div>

@jerber - I think it depends on your use case.

Protecting a user from **querying** a certain field is not possible yet without creating a new node, and blocking the entire node with an @auth rule.

However, this should be possible for **mutations** when the [update-after validation](http://discuss.hypermode.com/t/feature-request-update-after-auth-validation/14799/20) is hopefully released in the near future with something like this:

```auto
queryUsers(filter: { not: { has: role } }

```

Which would keep a user from **updating their role** i.e.

This should be possible now for **add** mutations, but they could easily get updated until this feature is added.

This is sort of a backend way of securing the field, but hopefully one day this feature will be added as a standalone security rule as well.

J

---

<div class="post-metadata">

**Author:** ![jerber](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jerber/32/8920_2.png) [@jerber](https://discuss.dgraph.io/u/jerber)\
**Post date:** [October 4, 2021, 7:45pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/17 "2021-10-04T19:45:35Z")

</div>

@jdgamble555 got it. Is this on the roadmap?

---

<div class="post-metadata">

**Author:** ![kolmez](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/kolmez/32/8710_2.png) [@kolmez](https://discuss.dgraph.io/u/kolmez)\
**Post date:** [December 1, 2021, 11:05am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/18 "2021-12-01T11:05:46Z")

</div>

well it was planned for the 21.07 release (like many many other features) but still waiting… no updates as of yet 😕

btw: 21.07 = july 2021 release

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [December 1, 2021, 1:40pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/19 "2021-12-01T13:40:44Z")

</div>

The last response the team gave me, they said this:

> [@Feature Request: Update After @auth Validation](http://discuss.hypermode.com/t/feature-request-update-after-auth-validation/14799/27):
>
> I am working on this feature and it will be available on next major release not 2109.

I have obviously been asking for an update several times, to no avail:

> [@Feature Request: Update After @auth Validation](http://discuss.hypermode.com/t/feature-request-update-after-auth-validation/14799/28):
>
> @aman-bansal - Since you guys are taking a big longer than expected for 21.09, do you think you could go ahead and add this update-after feature to it? There are no GraphQL features in 21.09 (I consider the null thing a bug fix), and this feature alone would go along way to appease your users. It is so powerful it opens so many doors to so many things, and should be quite easy to implement. Thanks! J

And yesterday, with no organization, on a random post, and ignoring the many other post asking for updates, we got this:

> [@Difference between docker tagged v21.03 and v21.03-slash](http://discuss.hypermode.com/t/difference-between-docker-tagged-v21-03-and-v21-03-slash/15088/5):
>
> The next release will be out soon. The version will be v21.12.

This seems to be not the next **major release** , so next July? Not a joke, I have no idea what that means. **21.12** does not seem to contain any new features for GraphQL, although I have seen other posts claiming it will contain **minor features** bug fixes (they call new features). At this point, I am very confused on what any of this means and cannot get a straight answer from anyone.

So that being said, I guess I am happy **21.12** will be release so that I can look forward to **22.07** maybe where they promised me the @update-after-auth fix?

No clue. All we have is nothing but questions at this point.

J

---

<div class="post-metadata">

**Author:** ![iluminae](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/iluminae/32/7367_2.png) [@iluminae](https://discuss.dgraph.io/u/iluminae)\
**Post date:** [December 1, 2021, 2:26pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/20 "2021-12-01T14:26:15Z")

</div>

You may not have seen the changeling for v21.12 GraphQL:

[https://github.com/dgraph-io/dgraph/raw/master/CHANGELOG.md](https://github.com/dgraph-io/dgraph/raw/master/CHANGELOG.md)

Is what you need there?

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [December 2, 2021, 1:20am UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/21 "2021-12-02T01:20:02Z")

</div>

No, @update-after-auth is not on the list.

J

---

<div class="post-metadata">

**Author:** ![loic](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/loic/32/9321_2.png) [@loic](https://discuss.dgraph.io/u/loic)\
**Post date:** [December 2, 2021, 12:33pm UTC](https://discuss.dgraph.io/t/using-auth-on-individual-fields/7208/22 "2021-12-02T12:33:46Z")

</div>

Subscribing to the issue as it is a critical feature for my use case!  
Not sure about @update-after-auth but surely for the @auth at a field level