Spring Boot GraphQL How to secure your GraphQL APIs in Java

If you have already created your first GraphAPI in Spring Boot your next question might be how to yo secure it. This tutorial will teach you how to secure your GraphQL APIs in Spring Boot using Spring Security.

🔗Resources & Links mentioned in this video:

👋🏻Connect with me:

[setok]

NIce video! Is there a way to disable the method security for a specific method only? For example: register and login methods.

[reedmurphy]

Hi Dan! Great video, my only question is that after I set up the security, although I can pass the first basic auth to get to the GraphiQL UI, immediately afterwards I am asked for my auth when I make it to the UI for the "graphql" path. Furthermore when I try to hit the graphql endpoint via postman it is saying I am unauthorized with a 401, so I supposed this is what is happening on the UI side of things as well. My GraphQL api worked before. I appreciate the video and any help.


import
import
import
import
import
import
import
import
import
import
import

@Configuration
@EnableWebSecurity
= true)
public class SecurityConfig {

@Bean
public InMemoryUserDetailsManager users() {
UserDetails user =
.username("user")
.password("password")
.roles("USER")
.build();
UserDetails admin =
.username("admin")
.password("password")
.roles("USER", "ADMIN")
.build();

return new InMemoryUserDetailsManager(user, admin);
}

@Bean
public SecurityFilterChain http) throws Exception {
return http
.csrf(csrf -> csrf.disable()) // (1)
.authorizeHttpRequests( auth -> {
// (2)
})
.sessionManagement(session -> // (3)
// (4)
.build();
}
}

import java.util.UUID;

import
import
import
import

import com.pojo.api.model.User;
import

@Controller
public class UserGraphQLController {

@Autowired
private UserService userService;

@Secured({"ROLE_USER"})
@SchemaMapping(typeName = "Query", field = "users")
public Iterable<User> users() {
return userService.getAllUsers();
}

}

[dipun]

This is really informative, I have one question:- How could i register a user with spring security enabled? as graphql having one URL (/graphql) and there is no ROLE while registering.

[ChrisB_Crisps]

Great video. I would like to see some best practices when 2 boot applications share the schema. One produces graphql and the other queries it through for example http. I am interested in approaches where the is shared. Solutions I have found so far: 1. copy pasting schema.graphqls (feels wrong to me in most scenarios), 2. using maven copy-resources plugin (this also I don't like it because it complicates the build on real world project) 3. having a maven module only with schema.graphqls and zero java code on that maven module (the model classes might be on that module but if the model classes also use things like Jackson annotations [without mixins], protobuff or avro; then the dependencies on the schema module and imports on model classes know about things that are not graphql)

[rohansingh]

Hey Dan,
Thanks for creating a playlist of GraphQL using SpringBoot.
Can you please cover more videos in this playlist for other topics like logging using AOP, Unit Testing using JUnit and Mockito and other important concepts. It would be really appreciating if you cover these topics soon.
Thanks in Advance

[omnnnooy]

what about testing? how to test secure API ?

[asdqwe]

How do I limit access to individual fields?

[alexgutjahr]

Great video, Dan! Also, where can we get a JVM hat from?

[AleksandarT]

Would be great if you can create similar video for this topic by using JWT tokens mechanism