graphql-authz VS graphql-shield

https://pothos-graphql.dev/docs/plugins/scope-auth https://github.com/AstrumU/graphql-authz

Today we are excited to introduce GraphQL AuthZ - a new open-source library for adding authorization layers on top of your existing GraphQL microservices or monolith backend systems.

GraphQL AuthZ is a new approach for applying GraphQL native authorization. We are happy that we can finally share this library with the community and keen to learn about the ways it might be used within your next project!

The announcement is at https://the-guild.dev/blog/graphql-authz and the repo at https://github.com/AstrumU/graphql-authz

The announcement is at https://the-guild.dev/blog/graphql-authz and the repo at https://github.com/AstrumU/graphql-authz

Compatibility with modern GraphQL technologies providing ways to wrap the graphql.js execute function. Here are a few working examples for Envelop, GraphQL Helix, Apollo Server, and express-graphql.

- https://github.com/dimatill/graphql-shield/issues/988 - https://github.com/dimatill/graphql-shield/issues/1485

Second a NextJS app is deployed to Vercel containing a GraphQL server function. This is an Apollo server that consumes the halo-graphql package using GraphQL Modules. The server also implements caching and rate limiting using GraphQL Shield.

GraphQL Shield is a great tool for creating authorization layers that has vast adoption from the community. In fact, GraphQL AuthZ is highly inspired by GraphQL Shield! However, GraphQL Shield uses a different approach compared to GraphQL AuthZ for applying authorization rules.

Haven't used it yet but GraphQL Shield looks pretty good. https://github.com/maticzav/graphql-shield

You can also use libraries like GraphQL Shield which offers powerful middlewares to do this. But remember that authorization does come with attached cost since you are running a specific logic in/before your resolvers for all the fields which you want to authorize.

Try graphql-shield