Custom authentication providers

[marktani]

Offer a custom authentication provider that uses functions for signup/verification of tokens.

[Noitidart]

I was thinking of doing this:

On signup:
Client creates hash of password. Hits endpoint, the endpoint stores it. (validation via email using probaly some email service

On Login:
Hash of entered password sent to endpoint, if it matches the hash in database, then it generates a session key and stores it in database, and returns to client the session key.

On page loads (and any "logged in requests" really):
The session key is sent along with each request, and compared to session key generated on login, then returns data. If the session key is bad then data is not returned so not logged in page is shown.

Does anyone have any ideas on how secure this approach is?

[Noitidart]

Oh idea! what I'll do is just create an endpoint on my server. This server will do the validation of the sessionkey, if it is good then it does a curl to graph.cool and returns the response. I can also have my server do any hashing/checking.

The only problem is I pay 40$ a year for my server + domain + database of unlimited data. Graphql alone is $45 a month ($540/yr) or maybe $9/month ($108/yr). I needed a solution I could hand off to college income/spending kids.

[marktani]

What we're rather thinking of is giving you a way to define the needed methods either in the form of microservices (AWS Lambda, Auth0 webtask, micro/now, Azure Functions) or by defining say JavaScript code right in the Console. That means little or no additional costs while you stay in control of authentication.

So for example you would need to define these methods:

• createUserSecret(email, password): String
• verifySignedToken(token): boolean

Your idea sounds flawed as a malicious client could simply bypass your server and curl Graphcool directly.
We'll have to hold back this feature to collect enough use cases and come up with a solid approach here though, so thanks for your ideas!

[marktani]

Similar to #43, this can be further discussed here: https://www.graph.cool/forum/t/feedback-schema-extensions-beta/405.