Search for a command to run...
Authenticating the HTTP request that carries a GraphQL query is not enough.
Each field resolver that returns sensitive data or mutates state needs its own authorization check for that actor, object, and action. A single top-level "logged in" gate still lets a clever query walk into nested fields the caller should never see.
Authorize at the leaf, not only at the entrypoint.
No comments yet. Be the first to comment.
A second factor proves the person is still at the keyboard. It does not decide whether that person may read, edit, export, or delete a specific resource. The bug pattern A common flow: User tries a s
Magic links prove the inbox at click time. They do not mean that user should still read, edit, or export that resource an hour later. The bug pattern A common flow: User requests access to a document
List endpoints often authorize once on page one, then trust the cursor for every next page. That is how a revoked membership keeps paging through results you meant to cut off. The bug pattern A common
Subscribing a client to a channel after login is not the same as authorizing every event you later push on that socket. The bug pattern User connects with a valid session. Server joins them to tenant
Soft-delete is a data lifecycle choice. Authorization is a security decision. Mixing them up is how tombstoned rows keep answering "yes" long after the product thinks they are gone. The bug pattern A
Auth By Example
41 posts
