GraphQL Authorization AspNetCore

A toolset for Asp.net core authorizing integrate to graph types for GraphQL .NET GraphQL .NET.

This project is base on GraphQL .Net Authorization.

Usage

• Register the authorization classes in your AspNetCore ConfigureServices before GraphQL .NET.
• Define your own GraphQLUserContext and add it to GraphQL .NET.
• Use GraphQLAuthorize attribute if using Schema + Handler syntax.

Examples

Define UserContext.

public class GraphQLUserContext : IProvideClaimsPrincipal
{
    public ClaimsPrincipal User { get; set; }
}

Inject service.

services.AddGraphQLAuth();

services.AddGraphQL(options =>
{
    options.ExposeExceptions = true;
}).AddUserContextBuilder(context => new GraphQLUserContext { User = context.User });

Define a policy.

services.AddAuthorization(options =>
{
    options.AddPolicy("AdminPolicy", policy => policy.RequireClaim("Admin");
});

GraphType first syntax - use AuthorizeWith.

public class MyType : ObjectGraphType
{
    public MyType()
    {
        this.AuthorizeWith("AdminPolicy");
        Field<StringGraphType>("name").AuthorizeWith("SomePolicy");
    }
}

Schema first syntax - use GraphQLAuthorize attribute.

[GraphQLAuthorize(Policy = "MyPolicy")]
public class MutationType
{
    [GraphQLAuthorize(Policy = "AnotherPolicy")]
    public async Task<string> CreateSomething(MyInput input)
    {
        return Guid.NewGuid().ToString();
    }
}

.Net Core 3.0

New version only surpport .net core 3.0, it surpport Nullable Reference Types.