Yep, that is an awesome thread. I probably spent hours pouring over it.
I’m also interested in possibly using GraphQL. While looking into it, it appears GraphQL really doesn’t have an opinion about authZ (or authN, for that matter).
While researching this more, I found these talks really helpful:
Facebook GraphQL Stack.
Dan Schafer at FB, react-europe 2016
Tony Ghita - Twitch’s GraphQL Transformation
The basic points of both talks seems to be:
*GraphQL wasn’t Facebook’s first API, they had other ones.
*Having all of the business logic live underneath the API layer, and the API layer being a thin layer on top of that, proved to be a robust architecture for Facebook.
*Push authorization out of GraphQL/REST, into a different layer.
*Authorization rules should emerge from your business logic.
One implication is, there are lots of great libraries and protocols for the hard stuff in authN. But for authZ, it might be harder to use a generic library as-is, since that is really getting into the specifics of your application and its unique business logic.
