Best practice for AuthN and AuthZ

[margaretjoanmiller]

I was wondering how folks are handling authentication and authorization and how each approach went. I need to restrict certain data to specific roles.

[fasibio]

Simple use an Auth graphql directive?
There you can also check for roles.
But this is not gqlgen specific is graphql standard way

[margaretjoanmiller]

Like this but implemented in go? https://github.com/graphql-community/graphql-directive-auth? I can't see from the official specs an official auth directive

[fasibio]

Mhm more or less. But in general you have the Auth token as header by your request.
Than on server side you have to read them and interpret them.
Did you read this https://gqlgen.com/reference/directives/ ? How directives work in gerneral?