Using Apollo Server, I get around authentication with an auth query which updates the context object of the query with the auth token of the user. Then, any subsequent queries can use that auth token to authenticate the user and authorize it for the query themselves.

I've also seen it where the authentication is handled by middleware before GraphQL even touches the request. I figure those two methods work for about every use case.

I do auth with a simple Ajax form and make all of my graphql calls take an auth header. Auth is really somewhat orthogonal to graphql. You can do it with graphql or not, up to you.

No more than HTTP or SQL fixes these problems on their own.