API / Apollo Gateway Interview questions
How does Apollo Gateway handle authentication and authorization?
Gateway doesn't implement auth logic out of the box — that responsibility is typically split between the gateway layer and each subgraph.
A common pattern: the gateway validates or parses the incoming token (a JWT, say) via a custom data source, and forwards the relevant claims to subgraphs as headers on each outgoing request. This is done by overriding buildService to return a custom RemoteGraphQLDataSource subclass with a willSendRequest hook that attaches those headers.
Each subgraph then enforces its own field- and type-level authorization using those forwarded claims, since it best understands its own domain's access rules — the gateway generally isn't in a position to know, for example, exactly which fields on a Reviews type require moderator access.
More Related questions...
