Authentication

Authentication is the process of verifying that a user is who they claim to be and should be handled by the framework you are using. Some already have a built-in authentication system (like Django); others, you have to provide it manually. It's not Strawberry's responsibility to authenticate the user, but it can be used to create a mutation that handles the authentication's process. It's also very important not to confuse authentication with authorization: authorization determines what an authenticated user can do or which data they can access. In Strawberry, this is managed with Permissions classes.

Let's see how to put together these concepts with an example. First, we define a login mutation where we authenticate credentials and return LoginSucces or LoginError types depending on whether the user was successfully authenticated or not.

import strawberry
from .types import User
@strawberry.type
class LoginSuccess:
user: User
@strawberry.type
class LoginError:
message: str
LoginResult = strawberry.union("LoginResult", (LoginSuccess, LoginError))
@strawberry.type
class Mutation:
@strawberry.field
def login(self, username: str, password: str) -> LoginResult:
# Your domain-specific authentication logic would go here
user = ...
if user is None:
return LoginError(message="Something went wrong")
return LoginSuccess(user=User(username=username))

Access authenticated user in resolver

Its fairly common to require user information within a resolver. We can do that in a type safe way with a custom context dataclass.

For example, in FastAPI this might look like this:

from functools import cached_property
import strawberry
from fastapi import FastAPI
from strawberry.fastapi import BaseContext, GraphQLRouter
from strawberry.types import Info as _Info
from strawberry.types.info import RootValueType
@strawberry.type
class User:
... # This is just a stub for an actual user object
class Context(BaseContext):
@cached_property
def user(self) -> User | None:
if not self.request:
return None
authorization = self.request.headers.get("Authorization", None)
return authorization_service.authorize(authorization)
Info = _Info[Context, RootValueType]
@strawberry.type
class Query:
@strawberry.field
def get_authenticated_user(self, info: Info) -> User | None:
return info.context.user
async def get_context() -> Context:
return Context()
schema = strawberry.Schema(Query)
graphql_app = GraphQLRouter(
schema,
context_getter=get_context,
)
app = FastAPI()
app.include_router(graphql_app, prefix="/graphql")

Was this helpful? What can we improve?

Edit on Github

Newsletter 💌

Do you want to receive the latest updates on Strawberry? Subscribe to our newsletter!