How can I do JWT authentication in Ariadne?

[ohduran]

I've searched extensively and could not find anything on JWT authentication with Ariadne. Before attempting to do it myself, am I missing something?

[dorianamouroux]

Hello 👋

This is not the role of Ariadne. Ariadne will take a Schema and an incoming request, and return the appropriate data; using a passed context.

In that context you can pass the request object; or directly the user object; but the authentication should happen before the graphql function is called.

[ohduran]

Hi @dorianamouroux thanks for your quick response! Looking at the docs, I found that it showcases a simple authentication in the spirit of what you're mentioning. I was wondering if you could point me to any post or video that could delve a bit deeper into how best to implement the authentication mechanism, using GraphQL rather than . Does it happen at the Django/Flask/FastAPI level? I sense from your answer that it is indeed the case. Is that right? Given this plugin available for graphene, I was hoping to find something similar. Thanks in advance.

[Usama0121]

@ohduran have a look at ariadne-jwt which is similar to django-graphql-jwt.

[shivamsainis]

I've searched extensively and could not find anything on JWT authentication with Ariadne. Before attempting to do it myself, am I missing something?

Did you find a way how to implement it?

[ohduran]

I'm afraid not. I was indeed deciding whether to try Ariadne or go for Graphene, and had to go for the latter in order to implement this feature (not without its own challenges).

[rafalp]

Sorry to hear that Ariadne failed you here, @ohduran :(

You didn't mention what stack you are using in OP, but generic approach to auth in GraphQL is usually having mutation that takes authentication credential and returns auth token that should be somehow passed from the client to the server in all future queries.

As for reversing this token into user data, there are different approaches:

• Wrap Ariadne in middleware that eagerly converts auth token into user that context_value then exposes.
• Convert this auth token eagerly into user at the time of context_value creation.
• Have a function like get_auth_user(info.context) that resolvers can call, which returns authenticated user for query context, checking first context has valid auth data. This is approach I'm using, but only because I have quite a lot of fields in query that don't care about auth at all so I don't want to run my project's pricey auth flow if I don't have to.

We could write this down in the guide eventually, but we don't have comfort of assuming elements of the stack like graphene-django does.

[Alexander-Trinh]

@rafalp It would be very helpful if you had simple guide added somewhere in the docs for authenticatoin and authorization purposes. Coming from REST API patterns I am used to having authentication and authorization resolved at the request level (for exmaple in Django using rest-framework where I just add extra methods to restrict access to the given resource), so I am wondering how to properly implement this in the GraphQL based libraries. I find Ariadne much cleaner and better compared to graphene, so I want to stick to this framework regardless.

[trbhoang]

I'm also using ariadne for my customer's projects now. I also found lack of library support jwt authentication based on ariadne.
The best one that I found is ariadne-jwt.
I already implement token-based authentication module for my customer using ariadne and ariadne-jwt and it works well for me :)

[pylipp]

FYI there's also flask-jwt-extended with extensive documentation.

[pylipp]

Does anybody experience with integrating a concept similar to graphql-shield in ariadne?
Or with using an authorization manager like oso?