Overview

In this module, we will cover how we can extend the GraphOS Router security mechanisms using a coprocessor.

Coprocessor

The GraphOS Router gives you the ability to customize the behavior of your GraphQL request processing in many different ways:

• YAML configuration
• Rhai scripting
• Custom Rust plugins

The most flexible way to modify the behavior of the router and extend its functionality is with a coprocessor. Coprocessor are simple HTTP applications you can use to implement:

• External authentication & authorization (for example, OPA)
• Custom data governance rules (for example, data redaction and tokenization)
• Custom analytics and performance monitoring

You can write a coprocessor in any programming language that has an HTTP library.

To register a coprocessor, you'll need to include the coprocessor endpoint in the router's YAML file.

Processing stages

There are four different router processing stages that you can modify: RouterRequest, RouterResponse, SubgraphRequest, and SubgraphResponse.

For more information about each stage, check out the Apollo documentation.

The current state

We'll be utilizing a coprocessor to implement a data governance rule that ensures that no credit card data is exposed in our GraphQL responses.

Let's retrieve the user's credit card information and see what happens without the coprocessor enabled.

1. In the Explorer tab of Studio, copy the following operation:

   GetUserCreditCards

   query GetUserCreditCards($userId: ID!) {
     user(id: $userId) {
       paymentMethods {
         id
         cardNumber
       }
     }
   }

   Copy

2. In the Variables panel, add the following JSON:

   Variables for the above query

   {
     "userId": "1"
   }

   Copy

3. Run the operation. You should receive data containing the user's payment methods, with their credit card numbers revealed in plain view.

   https://studio.apollographql.com

   

As you can observe, the credit card number is visible, which is highly unsafe. Let's activate our coprocessor to mask or redact this information.

Using a coprocessor

To make things simple, we've already created a coprocessor for you. You can take a look at the coprocessor code in the GitHub page.

We've also deployed it to this URL: https://coprocessor-wn3vwa6nlq-ue.a.run.app.

1. Open up the router.yaml file in GitHub.

2. Add the following configuration to the end of the file:

   router.yaml

   coprocessor:
     url: https://coprocessor-wn3vwa6nlq-ue.a.run.app
     timeout: 2s
     router:
       response:
         body: true

   Copy

3. Commit the change.

   https://github.com

   

With this change, your router is now connected to the coprocessor.

Check your work

Jumping back to the Explorer tab on Studio, let's run that GetUserCreditCards operation again.

In the Variables panel:

You should now see that the credit card numbers on the response are masked, showing up as ****-*****-****.

Success! We have now implemented a coprocessor to mask sensitive data in our responses 🎉🎊🥳!

Up next

In the next section, we'll learn how to optimize our collaboration schema workflow by using schema proposals.