# How to correctly restrict access to nested content in Neo4J-GraphQL?

**URL:** <https://community.neo4j.com/t/how-to-correctly-restrict-access-to-nested-content-in-neo4j-graphql/63417>\
**Category:** GraphQL & GRANDstack\
**Created:** [July 25, 2023, 11:48am UTC](https://community.neo4j.com/t/how-to-correctly-restrict-access-to-nested-content-in-neo4j-graphql/63417 "2023-07-25T11:48:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rioultf](https://avatars.discourse-cdn.com/v4/letter/r/7ab992/32.png) [@rioultf](https://community.neo4j.com/u/rioultf)\
**Post date:** [July 25, 2023, 11:48am UTC](https://community.neo4j.com/t/how-to-correctly-restrict-access-to-nested-content-in-neo4j-graphql/63417/1 "2023-07-25T11:48:45Z")

</div>

I'd like to implement a basic Post system, such as [described in the documentation](https://neo4j.com/docs/graphql-manual/current/authentication-and-authorization/authorization/).

A Post is related to a user, I'd like a Post to be only created/updated/deleted by its author.

```auto
type Post {
  title: String!
  content: String!
  author: User! @relationship(type: "AUTHORED", direction: IN)
}

type User @authorization(validate: [{ when: [BEFORE], where: { node: { id: "$jwt.sub" } } }]$
  id: ID @id
  username: String!
  password: String! #@private
  roles: [String!]
}

```

As I set authorization for User, creating or accessing a Post is working fine when sending the right token, e.g. with

```auto
mutation CreatePosts {
  createPosts(
    input: [
      {
        author: {
          connect: {
            where: { node: { id: "bab52c2f-9e09-4abc-871c-c921686a0ab0" } }
          }
        }
        content: "content"
        title: "title"
      }
    ]
  ) {
    posts {
      content
      title
      author {
        username
      }
    }
  }
}

```

With this schema setting, no authorization is needed to delete a Post, and **that's an issue**.  
I tried to restrict with the following, coming from the documentation :

```auto
type Post @authorization(filter: [
    { where: { node: { author: { id: "$jwt.sub" } } } }
]) {
...

```

- with a correct token, the returned author after `CreatePosts` is `null`
- with a bad token, I get `"Forbidden"`

With `@authorization(validate: ...` I always get `"Forbidden"`.

I couldn't manage to use `@authentication` with other restriction that `roles_INCLUDES`.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![rioultf](https://avatars.discourse-cdn.com/v4/letter/r/7ab992/32.png) [@rioultf](https://community.neo4j.com/u/rioultf)\
**Post date:** [August 16, 2023, 12:52pm UTC](https://community.neo4j.com/t/how-to-correctly-restrict-access-to-nested-content-in-neo4j-graphql/63417/2 "2023-08-16T12:52:00Z")

</div>

Be careful when copying the code about `User` and remove the `$` coming from `jed`. The correct header is:

```auto
type User @authorization(validate: [{ when: [BEFORE], where: { node: { id: "$jwt.sub" } } }]){

```