How is authentication handled in GraphQL?

GraphQL does not prescribe authentication — it is handled at the transport layer (HTTP middleware) and passed to resolvers via the context object. The typical pattern: an HTTP middleware (Express, Fastify) validates the Authorization header (JWT or session token) and attaches the authenticated user to the context. Each resolver then reads context.user to check identity. Example: const resolvers = { Query: { me: (_, __, ctx) => { if (!ctx.user) throw new AuthenticationError('Not logged in'); return ctx.user; } } }. This clean separation means authentication logic lives in one place while resolvers focus on data access.