--- title: A GraphQL field resolver still needs its own... description: Discussion about "A GraphQL field resolver still needs its own authorization check" on daily.dev - join the developer community canonical: https://daily.dev/posts/a-graphql-field-resolver-still-needs-its-own-authorization-check-9zq0ou1bm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A GraphQL field resolver still needs its own authorization check | daily.dev og:description: Discussion about "A GraphQL field resolver still needs its own authorization check" on daily.dev - join the developer community og:url: https://daily.dev/posts/a-graphql-field-resolver-still-needs-its-own-authorization-check-9zq0ou1bm og:image: https://api.daily.dev/og/posts/9ZQ0ou1Bm.png og:image:alt: A GraphQL field resolver still needs its own authorization check og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A GraphQL field resolver still needs its own authorization check **[Auth By Example](https://daily.dev/sources/7eadcwhmohx0bchehapmt)** · [@authbyexample](https://daily.dev/authbyexample) · 0 upvotes · 0 comments ## Content Resolving a nested field is not the same as authorizing it. The parent query may have confirmed the viewer can open Account X, but that does not imply they can read payrollHistory, exportTaxDocs, or sibling accounts linked through a connection. A resolver that only checks "is authenticated" or trusts the parent object it received is how GraphQL turns into an IDOR/BOLA surface. Keep authorization local to the field (or to a shared helper the field must call): 1. For every sensitive field or mutation, decide can(viewer, action, resource) using the authenticated principal and the concrete object id — not only the parent type name. 2. List/connection resolvers must filter by authorization (or post-filter with a real check). Returning ids the viewer cannot read and hoping the child resolver fails later still leaks existence and shape. 3. Do not treat @auth on the operation root as enough for nested fields. Operation-level auth answers "may you run this query shape?"; field-level auth answers "may you see this value?" 4. Batch/DataLoader paths still need per-object decisions. A loader that hydrates 50 records must not skip checks because the parent already authorized one of them. 5. Prefer deny-by-default when the lookup fails or the policy is missing. A null field is better than a silent leak. Quick check: authenticate as a normal user, request a parent you own, and ask for a privileged nested field on a sibling or admin-only relation. If the field returns data without a dedicated authz decision, the schema is the vulnerability — not the client. GraphQL makes nested reads easy. Authorization has to nest with them. --- [View this post on daily.dev](https://daily.dev/posts/a-graphql-field-resolver-still-needs-its-own-authorization-check-9zq0ou1bm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/a-graphql-field-resolver-still-needs-its-own-authorization-check-9zq0ou1bm","headline":"A GraphQL field resolver still needs its own authorization check","text":"Discussion about \"A GraphQL field resolver still needs its own authorization check\" on daily.dev - join the developer community","url":"https://daily.dev/posts/a-graphql-field-resolver-still-needs-its-own-authorization-check-9zq0ou1bm","datePublished":"2026-10-02T05:46:30.431Z","dateModified":"2026-10-02T05:46:30.431Z","author":{"@type":"Person","name":"Auth By Example","url":"https://daily.dev/authbyexample","image":"https://media.daily.dev/image/upload/s--Fgz7IgGQ--/f_auto/v1789653205/avatars/avatar_7EADCwHmOHX0bChEhAPmt?_a=BAMAMicg0","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":60}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7eadcwhmohx0bchehapmt","name":"Auth By Example"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth By Example","item":"https://daily.dev/sources/7eadcwhmohx0bchehapmt"},{"@type":"ListItem","position":3,"name":"A GraphQL field resolver still needs its own authorization check"}]} ```