The general recommendation is to handle authentication outside of GraphQL itself, passing in the information of the current viewer through the rootValue interface provided to you.
app.use('/graphql', (request, response, next) => {
const viewer = getViewerFromRequest(); // You provide this.
const options = {
rootValue: {
viewer,
},
schema,
};
return graphqlHTTP(request => options)(request, response, next);
});And then inside the schema you have access to your rootValue and can use that for the purposes of access control and authorization:
resolve: (parent, args, {rootValue}) => {
const viewer = {rootValue};
// Code that uses viewer here...
}