Help getting started with subscriptions

[chelliwell]

I'm evaluating this library for a new project. I figure the Querying is pretty solid, so I'm checking out subscriptions instead. I'm using the 'subscriptions-api' branch.
I assume GraphQL.Client.Sample is a suitable app to start with? I've modified port and subscribe message for my (Apollo) server, but hit an exception in GraphQL.Client.Http.GraphQLHttpSubscriptionResult.StartAsync() [#45]: "Cannot convert type 'Newtonsoft.Json.Linq.JObject' to 'GraphQL.Common.Response.GraphQLResponse'"
Payload is
{{ "message": "Invalid message type!" }}

I doubt my experimental server is geared up to use ws-only, but I don't think this app is configured like that anyway? I can setup and get subscription messages when I experiment using GraphQL 'Playground' UI. The server does see an onDisconnect when the client is stopped, yet doesn't see the onConnect.
I will maybe try to wireshark it, but any tips please on how to get a bit further?

[chelliwell]

Bit of wiresharking of the HTTP/WS transactions.
My server btw is using apollo-server 2.5.0 and apollo-server-express 2.5.0.
With the Playground UI:

GET /graphql HTTP/1.1
Host: localhost:4000
Connection: Upgrade
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
Origin: http://localhost:4000
Sec-WebSocket-Version: 13
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Sec-WebSocket-Key: Tqa3rJ0Jr/PUFnRnXgUuMA==
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Sec-WebSocket-Protocol: graphql-ws


HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: IDq5+RJfVkxIzEmwhrZpzbro+6Q=
Sec-WebSocket-Protocol: graphql-ws


=>  {"type":"connection_init","payload":{}}

=>  {"id":"1","type":"start","payload":{"variables":{},"extensions":{},"operationName":null,"query":"subscription {\n  postAdded {\n    author\n    comment\n  }\n}\n"}}

<= {"type":"connection_ack"}

With GraphQL.Client.Sample:

GET /graphql HTTP/1.1
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: rJsSOP5Sp0Gvmu0MtgwceA==
Sec-WebSocket-Protocol: graphql-ws
Host: localhost:4000


HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: KM5lUfIGEjJOsv5KVsoiXNs0WNg=
Sec-WebSocket-Protocol: graphql-ws


=>  {"Id":"1","Type":"start","Payload":{"Query":"subscription { postAdded{ author comment }}","OperationName":null,"Variables":null}}

<=  {"type":"error","payload":{"message":"Invalid message type!"}}

[rose-a]

I recommend using the CreateSubscriptionStream method on GraphQLHttpClient to create a subscription (you need to subscribe to the returned IObservable to actually start the connection).

[chelliwell]

Took guidance from the IntegrationTest - scruffily coded at present, but I can now both subscribe and receive the posted messages. Thanks.

[chelliwell]

Follow-on question then please, if I may: what class/level do I need to be looking at for creating a (2 way) certificate-based TLS connection?

[rose-a]

This all veeery much depends on your setup/environment and not so much on this library, since it just uses HttpClient which abstracts away the HTTP transport layer.

If your server uses a valid certificate (expiration date is not due, issued to your FQDN by a trusted CA => one that does not make your browser complain about security risks) you're good to go...

Otherwise please consult good old Google on how to use HttpClient with self-signed certificates...

[chelliwell]

Ok thanks Alexander. I do have valid certs - I've proven out 2-way authentication to my Apollo server (with a LetsEncrypt server cert and self-signed client certs) using just curl as a basic Query client. Need to look at HttpClient then I guess - wasn't at sure what level this stuff is dealt with.

[rose-a]

Well, generally you just have to use the https URL to use https...

If you're trying to do Authorization, GraphQLHttpClient exposes the DefaultHttpHeaders of the underlying HttpClient, where you can set the authorization header.

[chelliwell]

Not (as I understand terminology) authorization, but actual authentication using TLS. So I need to drill in somewhere (into HttpClient, by the sound of it) to be able to set up the client certificate and key. (The server has a valid and trusted cert, but I need to use client certs too).

[chelliwell]

Not sure if I've missed something or its something in the library: I can do a query with mutual [TLS] authentication, but am unable to subscribe. Apollo reports "peer did not return a certificate".
I think it's something in the ws area - the query no longer works if I use UseWebSocketForQueriesAndMutations=true in the GraphQLHttpClient options. I get an exception "System.Net.WebSockets.WebSocketException: 'Unable to connect to the remote server'"
I wonder if the websocket is needing an option somewhere?
On my HttpClientHandler, passed to GraphQLHttpClient, I am setting:

handler.ClientCertificateOptions = ClientCertificateOption.Manual;
handler.SslProtocols = SslProtocols.Tls12;
handler.ClientCertificates.Add(new X509Certificate2("clientA-cert-and-key.pfx"));

Any thoughts/experience, or debugging suggestions, please? (Don't know if this authentication is a mechanism you've tried). Maybe it's more of a .NET/WS issue - I'll have to try some more reading tomorrow too.

[chelliwell]

I think, at a first quick look (cos I gotta get home soon!) - it maybe needs being able to get some ClientWebSocketOptions in, for instance, GraphQL.Client.Http.GraphQLHttpWebSocket.InitializeWebSocket() ...?
[I'm not familiar with .NET WebSockets]

[chelliwell]

I think, at a first quick look (cos I gotta get home soon!) - it maybe needs being able to get some ClientWebSocketOptions in, for instance, GraphQL.Client.Http.GraphQLHttpWebSocket.InitializeWebSocket() ...?
[I'm not familiar with .NET WebSockets]

Confirmed. If I add
nativeWebSocket.Options.ClientCertificates.Add(new X509Certificate2("My-cert-and-key.pfx", "mypassword"));
then the authentication succeeds. I think the websockets layers therefore need a way for the app to be able to pass these options down? (Possibly 'UseDefaultCredentials' too)

[chelliwell]

I doubt my experimental server is geared up to use ws-only, but I don't think this app is configured like that anyway? I can setup and get subscription messages when I experiment using GraphQL 'Playground' UI. The server does see an onDisconnect when the client is stopped, yet doesn't see the onConnect.

Although I've now got subscriptions working better, I'm still seeing - even without TLS - a difference between my client app and Playground: the server fires the 'onConnect' with Playground but not with my client app on this library.
I've raised it on Apollo discussion group too - its maybe neither specifically faulty, just one expecting one thing and the other expecting something else.

[curbol]

I recommend using the CreateSubscriptionStream method on GraphQLHttpClient to create a subscription (you need to subscribe to the returned IObservable to actually start the connection).

Any estimate for when this will be available in nuget?

[chelliwell]

I doubt my experimental server is geared up to use ws-only, but I don't think this app is configured like that anyway? I can setup and get subscription messages when I experiment using GraphQL 'Playground' UI. The server does see an onDisconnect when the client is stopped, yet doesn't see the onConnect.

Although I've now got subscriptions working better, I'm still seeing - even without TLS - a difference between my client app and Playground: the server fires the 'onConnect' with Playground but not with my client app on this library.
I've raised it on Apollo discussion group too - its maybe neither specifically faulty, just one expecting one thing and the other expecting something else.

#116