Hot Chocolate Security Docs. #3584
Conversation
|
Kudos, SonarCloud Quality Gate passed!
|
There was a problem hiding this comment.
Good job! I was thinking of documenting Authorization myself next. I think this will help a lot of folks! :)
Maybe you could rename the directory from Security to security, so it fits the other directories. I'm not sure how it's handled, but the uppercase letter might look off in the URL.
Also it would be nice, if you could integrate these documents on the website. I would like to read them again on the actual website locally.
|
|
||
| We basically can do it in any way ASP.NET core allows us to. | ||
|
|
||
| [Overview of ASP.NET Core authentication](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-3.1) |
There was a problem hiding this comment.
I think it would be helpful to add a section on how to access the authenticated user (ClaimsPrincipal) in your resolver.
There was a problem hiding this comment.
Authorization docs are not done yet ... just copied them from V10.
|
|
||
| The `@authorize`-directive on a field takes precedence over one that is added on the object type definition. | ||
|
|
||
| SDL-First: |
There was a problem hiding this comment.
I think the ExampleTabs would be better suited for the code examples in these documents.
| protected override Configure(IObjectTypeDescriptor<Person> descriptor) | ||
| { | ||
| descriptor.Authorize(); | ||
| descriptor.Field(t => t.Address).Authorize(); |
There was a problem hiding this comment.
This is not equivalent to the other examples.
|
|
||
| > If the field is a non-null field the standard GraphQL non-null violation propagation rule is applied like with any other GraphQL error and the fields along the path are removed until the execution engine reaches a nullable field or the while result was removed. | ||
|
|
||
| ## Roles |
There was a problem hiding this comment.
I think we could also mention, that in general it would be a good/better idea to do validation of roles inside your business logic layer, i.e. inject the ClaimsPrincipal into your business layer. That way you don't have the issue of roles getting out of sync, if you are for example hosting a REST and GraphQL service side-by-side.
src/HotChocolate/Core/src/Execution/Caching/IComplexityAnalyzerCache.cs
Outdated
Show resolved
Hide resolved
michaelstaib
changed the title
michaelstaib
changed the title
No description provided.