Website guide for authentication

[jasonkuhrt]

What

• Guide section about authentication
• Note: This is not about authorization
• Should focus on JWT based system, industry standard

unresolved

• Focus on PassportJS?
• Special case Auth0?
• Focus on Identity Provider integration or everything self-hosted?
• me/viewer graphql schema?
  • https://stackoverflow.com/questions/37635328/what-is-the-meaning-of-viewer-field-in-graphql
  • Auth via viewer vs context graphql/graphql-js#571
  • https://medium.com/workflowgen/graphql-schema-design-the-viewer-field-aeabfacffe72

Why

• A core aspect of building many apps
• Eventually we want this to be a core aspect of santa framework

How

• Need to research how santa@1 will tackle this domain in the first place
• Then need to refine the engineering into GitHub issues

Related

• Website #210

References

Articles

• 2019 https://www.youtube.com/watch?v=RUZB8tpyDbQ
• 2019 https://www.youtube.com/watch?v=25GS0MLT8JU
• 2019 https://www.youtube.com/watch?v=zbp8LZXBUYc
• 2019 https://flaviocopes.com/graphql-auth-apollo-jwt-cookies/
• 2019 https://blog.hasura.io/best-practices-of-using-jwt-with-graphql/ (frontend perspective)
• 2019 https://dev.to/novvum/implementing-authentication-using-jwt-bcrypt-and-graphql-nexus-29n6
• 2019 https://www.freecodecamp.org/news/how-to-nail-social-authentication-in-graphql-27943aee5dce/
• 2018 https://blog.pusher.com/handling-authentication-in-graphql/ (+ part 2,3)

Tools to build authN

• http://www.passportjs.org/
• https://auth0.com/
• https://github.com/kkemple/graphql-auth

viewer schema concept

• 2017 https://stackoverflow.com/questions/37635328/what-is-the-meaning-of-viewer-field-in-graphql
• 2017 https://medium.com/workflowgen/graphql-schema-design-the-viewer-field-aeabfacffe72
• 2016 Auth via viewer vs context graphql/graphql-js#571

From Perspective of Particular Tools

• https://www.apollographql.com/docs/apollo-server/security/authentication/
• https://buildkite.com/docs/apis/graphql-api#authentication
• https://developer.github.com/v4/guides/forming-calls/#authenticating-with-graphql

Other

• https://www.howtographql.com/graphql-js/6-authentication/

[sachaw]

Just a note I want to add about keeping whatever implementation open ended enough to allow for abstract authentication i.e. WebAuthn or WebAuthn over GraphQL
https://webauthn.guide/