Subscribe with Authentication is not working for me

[ClarenceMG]

var options = new GraphQLHttpClientOptions
{
     EndPoint = new Uri(APIUrl)
};

var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

var graphQLHttpClient = new GraphQLHttpClient(options, httpClient, new GraphQL.Client.Serializer.Newtonsoft.NewtonsoftJsonSerializer()); 

This is my client.

Now I try to subscribe:

IObservable<GraphQLResponse<object>> subscriptionStream = graphQLHttpClient.CreateSubscriptionStream<object>(request);

IDisposable subscription = subscriptionStream.Subscribe(response =>
{
    var value = response.Data;
    if (response.Data != null)
    {
        var serializeResponse = JsonConvert.SerializeObject(response);
        Console.WriteLine(serializeResponse);
    }
});

But I never receive a response.

[ClarenceMG]

IDisposable subscription = subscriptionStream.Subscribe(response =>
        {
            var value = response.Data;

            if (response.Data != null)
            {
                var serializeResponse = JsonConvert.SerializeObject(response);

                Console.WriteLine(serializeResponse);
            }
        });

After subscribe it I receive a response null.

[rose-a]

What exactly is null? response itself should never be null... If response.Data is null, response.Error will most likely contain the error stating the cause for that (which in your case could be something like "not authorized").

As on authorization via websockets, this is no easy topic. I'm quite curious on how this is implemented in your server (please let me know).

A websocket only sends HTTP headers once with the request to upgrade the HTTP connection to a websocket. Then you can send as many requests as you like via that websocket without ever sending that header again (how do you replace your token when it expires?).

This library opens a single websocket and reuses that as long as it can be kept open. If you set GraphQLHttpClientOptions.UseWebSocketForQueriesAndMutations to true it also sends queries and mutations over that connection (which reduces overhead).

In my own personal projects im using a PR build of graphql-dotnet/server which adds an authorization field to every request payload to be evaluated on a per request basis by the server, which works perfectly fine. To achieve that on the client side you'd have to reimplement one of the JSON serializer packages to include an authorization field in their internal GraphQLRequest object...

As for the server it obviously depends on the implementation you're using...

[ClarenceMG]

Immediately after subscribe me I receive a response with Data = Null, Errors = Null and Extensions = Null.

It could great if you provide us an example of how you implement this library.
Thank you.

[rose-a]

There is an example in the readme. You can find further examples inside the integration test project, although they're a bit obfuscated by test helpers and extension methods.

Show us your query string and request object, would you?

Also you shouldn't use object as TResponse. Either model a class for your response as shown in the readme or use the extension which accepts an anonymous type as an argument (see here, a equivalent extension method exists for CreateSubscriptionStream too).

[ClarenceMG]

This is my query:

subscription {
      activityAdded {
         reconditioningActivityId
         description
         isDefault
         requireApproval
         approvers
     }
}

This is my object:

public class ActivityAdded
{
     public string ReconditioningActivityId { get; set; }
     public string Description { get; set; }
     public bool IsDefault { get; set; }
     public bool RequireApproval { get; set; }
     public string Approvers { get; set; }
}

I did tests and the server not receive the token, I don't know if I'm not adding fine my DefaultRequestHeaders.

var options = new GraphQLHttpClientOptions
{
       EndPoint = new Uri(APIURL)
};

var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", MYTOKEN);

if (graphQLHttpClient == null)
{
       graphQLHttpClient = new GraphQLHttpClient(options, httpClient);
}

IObservable<GraphQLResponse<ActivityAdded>> subscriptionStream = graphQLHttpClient.CreateSubscriptionStream<ActivityAdded>(request);

IDisposable subscription = subscriptionStream.Subscribe(response =>
{
      if (response.Data != null)
      {
          var serializeResponse = JsonConvert.SerializeObject(response);

          dataChanged?.Invoke(serializeResponse);
      }
});

[ClarenceMG]

It should be noted that my server is running on ngrok. @rose-a

[ClarenceMG]

[ClarenceMG]

My server always receive context { } empty.
Do you know why is happening this? @rose-a

[rose-a]

Yes, that happens because this client does not send any context field.

What server library are u using? I suspect its apollo-server?

Currently there is no fixed specification on how to do authentication over websockets, and Apollo has from a quick glance decided to go for the "authenticate the websocket once on establishing the connection".

I myself prefer the approach to add the authentication token to each query/mutation/subscription payload so you can check this on each request and be able to change it without destroying and reestablishing the websocket connection (since im using the websocket for queries/mutations too). How this can be done with graphql-dotnet was descibed in an earlier answer.

As I already said the implementation has to match that of the server. Feel free to locate and share the specification your server is using or even do a PR implementing it.

[ClarenceMG]

Ok, thank you very much, now I am clear.
Just a question.
Regarding security, do you think it is advisable to send the token in the payload?
@rose-a

[rose-a]

Well, regarding security it doesn't matter if you send it in the payload or in a http header (like it's usually done with normal web requests).

You always need to encrypt your communication using https (or wss when websockets are concerned) when sending auth tokens around!

[ClarenceMG]

How do I add an extra field in the Payload?
For example:

context: {
    authorization: "Bearer <token>"
}

I tried adding a field in GraphQLRequest editing the library but I cannot do it work.

@rose-a

[rose-a]

Currently you'll have to reimplement one of the serializers (because that uses a private implementation of GraphQLRequest in order to correctly set JSON property names).

Edit: In v2.1.2 you can just Add() it, since GraphQLRequest is now based on Dictionary<string, object>...