Secure graphql Server with http headers

[ru4ert]

I want to secure the server with http headers. So i created a RequestFilter:

@Provider
@Unremovable
@Priority(Priorities.AUTHENTICATION)
public class KeyFilter implements ContainerRequestFilter {

  @Override
  public void filter(ContainerRequestContext requestContext) {
      // securing logic
  } 
}

But this isn't called. How to secure the server?

[jmartisk]

The code you've posted looks like a JAX-RS filter. You're dealing with GraphQL, not JAX-RS here, that's why it's not called.

If you're using Quarkus, you can use Quarkus's standard declarative security mechanisms, like it's described for example here: https://quarkus.io/guides/security-authorize-web-endpoints-reference - if you apply it on the /graphql* path it will protect the endpoint. The @RolesAllowed annotation should work along with it too.

[ru4ert]

@jmartisk
You're right. Its quarkus. Ok didn't know that GraphQL isn't under JAX-RS. I already noticed this ref but i didn't found it useful. With this approach your dealing with roles... I need a api key (in headers) approach.

[jmartisk]

I'm not sure how exactly I'd implement Api-key based security, but I assume it should be possible somehow, probably with Keycloak involved for managing the users and keys. Please ask at https://quarkusio.zulipchat.com/, there are people more knowledgeable in Quarkus security mechanisms and willing to help

[ru4ert]

I will give it a try there. Thanks a lot!

[ru4ert]

I came up with this solution:

@ApplicationScoped
public class GraphQLKeyFilter {

  private final String graphqlPath;

  @Inject
  public GraphQLKeyFilter(@ConfigProperty(name = "quarkus.smallrye-graphql.root-path") String graphqlPath) {
    this.graphqlPath = graphqlPath;
  }

  public void init(@Observes Router router, Vertx vertx) {
    router.route("/" + this.graphqlPath)
          .order(-900)
          .handler(routingContext -> {
            String apiKey = routingContext.request()
                                          .getHeader("X-API-Key");
           boolean isValid = apiKey == null
            if (!isValid) {
              routingContext.response()
                            .setStatusCode(Response.Status.UNAUTHORIZED.getStatusCode())
                            .end();
              return;
            }
            routingContext.next();
          });
  }
}