How to validate the authorization token

[geetparekh]

This section has useful information for how to do authorization. However, it does not show the details for how to implement the getUser function. The getUser() in this case, should take in the authorization header and return a response based on the validation. I propose to add those details too or provide a link to the document showing how to do that.

Following is what we do to validate the token and if it is fine, I can go ahead and create a PR editing the page with these details:

Also, we use Apollo Express Middleware, so probably these details can go in some other page too showing a reference for how to do this with the express server.

import JWT from "jsonwebtoken";

app.use('/graphql',
  cors<cors.CorsRequest>(),
  express.json(),
  expressMiddleware(server, {
    context: async ({ req }) => ({
      sessionConfig: {
        jwt: verifyTokenAndReturnPayload(req.headers.authorization)
      }
    })
  }));

/**
 * Verify token and return payload in case of successful verification. 
 * Else throw GraphQLError back as response to the request
 * 
 * @param authHeader 
 * @returns 
 */
function verifyTokenAndReturnPayload(authHeader: string){
  try {
    return JWT.verify(authHeader.split(' ')[1], token_secret);
  } catch (error) {
    console.log(error)
    throwAuthError();
  }
}

/**
 * Throw GraphQLError indicating user authentication failure
 */
function throwAuthError() {
  throw new GraphQLError('User is not authenticated', {
    extensions: {
      code: 'UNAUTHENTICATED',
      http: { status: 401 },
    },
  });
}

If there is an easier way to do this without importing jsonwebtoken library, I will be happy to change our implementation to use that. Noticed that what works with standalone server does not always work with the express middleware server. On the other hand, if the code above is good, I will be happy to contribute to the neo4j/graphql library to have a function available within it to validate the token.

[geetparekh]

Closing the issue here as I posted the same here

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
For general questions, we recommend using StackOverflow or our discord server.