graphql-security

name	graphql-security
description	Secure GraphQL APIs - authentication, authorization, rate limiting, and validation
sasmp_version	1.3.0
bonded_agent	06-graphql-security
bond_type	PRIMARY_BOND
version	2.0.0
complexity	advanced
estimated_time	5-7 hours
prerequisites	["graphql-fundamentals","graphql-resolvers","graphql-apollo-server"]

GraphQL Security Skill

Protect your GraphQL APIs from attacks

Overview

Learn essential security patterns for GraphQL: JWT authentication, role-based authorization, rate limiting, query complexity limits, and input validation.

---

Security Checklist

Check	Priority	Implementation
Authentication	Critical	JWT with refresh tokens
Authorization	Critical	Field-level with graphql-shield
Rate Limiting	Critical	Per-user/IP with Redis
Query Depth	High	graphql-depth-limit
Query Complexity	High	graphql-query-complexity
Introspection	High	Disable in production
Input Validation	High	Validate all inputs
Error Masking	Medium	Hide internal errors

---

Core Patterns

1. JWT Authentication

import jwt from 'jsonwebtoken';

// Token creation
function createTokens(user) {
  const accessToken = jwt.sign(
    { userId: user.id, roles: user.roles },
    process.env.JWT_SECRET,
    { expiresIn: '15m' }
  );

  const refreshToken = jwt.sign(
    { userId: user.id },
    process.env.JWT_REFRESH_SECRET,
    { expiresIn:  }
  );

   { accessToken, refreshToken };
}


  =  () => {
   token = req..?.(, );

   user = ;
   (token) {
     {
       payload = jwt.(token, process..);
      user =  db..(payload.);
    }  (e) {
      
    }
  }

   { user };
};


 resolvers = {
  : {
    :  (_, { email, password }) => {
       user =  db..(email);

       (!user || ! bcrypt.(password, user.)) {
          (, {
          : { :  }
        });
      }

       { ...(user), user };
    },
  },
};