Improving Maintainability in GraphQL Authorization using Dynamic Authorization

GraphQL is the new way to build an API that Facebook has developed. The rising trend of GraphQL has intrigued developers as it solves the REST API problems like under-fetching and over-fetching. Still, at the same time, it also brings additional security issues like authorization. GraphQL authorization is one of the most challenging and hot issues. As a state-of-the-art method to solve GraphQL Authorization uses hard-coded authorization rules, it increases the burden for a developer to develop in a maintainable way. This paper proposes a platform that alleviates the authorization problem in GraphQL in a maintainable way. This platform will showcase how to solve this problem in a microservices system. Authorization services will decouple the application, increasing the separation of concern between the application and security contexts. The experiment on the proposed system tested with an identical system shows that dynamic authorization will increase software maintainability, proved by the class coupling decreasing by 21%. Although the proposed design uses GraphQL technology, the approach is helpful for any distributed computing technology.