Fork me on GitHub
#graphql
<
2018-09-05
>
thosmos03:09:29

what's a good way to put a JWT token into the resolver context for use in the GraphiQL app for authorization?

👀 1
myguidingstar03:09:46

@thosmos I guess you would want to decode the token before associng it to context?

thosmos03:09:42

hmm, so if I'm using lacinia-pedestal this would be in an interceptor before lacinia? I'm just getting familiar with pedestal

thosmos03:09:30

I'd like to add the token to the URL query string like ...

myguidingstar03:09:53

So your question is specific to lacinia-pedestal? I don't use lacinia-pedestal myself 😐

thosmos03:09:36

I'm supposing it is, unless there's another way to do it ...

myguidingstar03:09:12

well, you can use com.walmartlabs.lacinia/execute directly. I think lacinia's unit tests would cover it

timgilbert19:09:14

@thosmos, I'm not as familiar with the pedestal stuff but in general you'd want to interceptor for that, I would think

timgilbert19:09:28

I work on a Ring app, and basically we've got middleware that decodes the token and puts it in request. For my app we don't even allow graphql access without a token, but in principle what you'd want to do is pull the data you need out of request and then assoc it into the lacinia app-context at the time you call (execute), like @myguidingstar was saying. Then in your resolvers you can pull the data back out of the context if you need to do something with it, via the third argument to your resolver functions.

thosmos21:09:56

@timgilbert thanks. yes, that's more or less what I figured out for the regular lacinia-pedestal backend service. It even provides an API for injecting a custom interceptor into its interceptor vector before creating the service. But I realized that the problem I'm attempting to solve is with the embedded GraphiQL frontend UI. I'd need to alter that to get it to modify the HTTP request header that it sends to the backend service. Since this need is just for development, instead what I did was use a browser plugin that adds a custom header that gets sent to the backend.

timgilbert21:09:59

Oh, cool, makes sense. For our auth stuff we set a cookie with the JWT token in it, which carries over from our main app to GraphiQL if they're both running on localhost.