Invalid Authorization Header

[approached]

Hi @ all

I just quick install this plugin and tried to use. Now i become on every request an error with a anonymus/guest/no barear token user.

Response:

{
  "errors": [
    {
      "debugMessage": "Invalid Authorization Header",
      "message": "Internal server error",
      "category": "internal",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "entries"
      ]
    }
  ],
  "data": {
    "entries": null
  }
}

After i disabed this plugin. It works great again. BTW: the graphQL dashboard doesn't work too.
Has anybody a idea?

[jamesedmonston]

@approached Would you be able to try running the latest commit from the develop branch to see if that fixes it? I've made a couple fixes in that branch that I'll be bundling into a release very soon.

[jamesedmonston]

@approached I've just released 1.2.1 which resolves this.

[approached]

I updated the package. But it has the same error 👎 . It is not working as aspected.

[jamesedmonston]

@approached Damn! Sorry about this. I will take another look.

Quick question, do you have Use HTTP-Only cookie enabled in settings?

[approached]

I have tried both. For me it's not clear for what this setting will used Use HTTP-Only cookie

I use as fronted nextjs. But it is not really clear how i can build a login/authentication process. JWT would be nice but no documation available.

Quick question, how i can refresh the token?
If i store the token in a local storage, does me need Use HTTP-Only cookie enabled?

[jamesedmonston]

@approached I'm just about ready to release an update which includes proper JWT and refresh token support. If you run the latest commit in the develop branch you should be able to get started with this.

I've rewritten the documentation using Docusaurus which includes more examples and explanations. This can be found here: https://graphql-authentication.jamesedmonston.co.uk

[jamesedmonston]

@approached I just managed to replicate this in a client project, and have pushed version 1.3.1 that actually fixes the issue. Sorry for the hassle!

[daltonrooney]

@jamesedmonston I'm experiencing this error on my front-end I wonder if it might be a conceptual problem on my part that could be cleared up with some documentation.

Can you confirm that all GraphQL requests must be authenticated when the plugin is active? I.e. no more public schema requests or Bearer token requests that reference a schema directly?

For my front-end, I've been working with the idea that most of the pages will be public and therefore wouldn't need to be authenticated. Then there's an "admin" section with protected routes where an authenticated user would have access to some non-public sections and mutations.

But if all requests must be authenticated, I guess I would have to create an anonymous user account and authenticate with that during build-time and for anonymous web users, correct?

[jamesedmonston]

@daltonrooney Damn.

Can you confirm that all GraphQL requests must be authenticated when the plugin is active? I.e. no more public schema requests or Bearer token requests that reference a schema directly?

This shouldn't be the case, but maybe the logic is broken somewhere. The intended functionality is that any requests against the public schema are left untouched.

But if all requests must be authenticated, I guess I would have to create an anonymous user account and authenticate with that during build-time and for anonymous web users, correct?

In the interim, you could create a schema that matches your public one, and create a token that's assigned to the new schema, then use that token to authorise your build-time calls.

Out of interest, are you using the new JWT setup?

If you go to https://graphiql-online.com, put in your endpoint, and run a public query, do you get the error?

[daltonrooney]

@jamesedmonston Yeah I've got JWT enabled, and I'm able to successfully authenticate with a Google ID token and get a JWT token back. 👍 But I do think something weird is going on with the public query:

(the graphiql-online.com query works when the plugin is disabled)

[jamesedmonston]

@daltonrooney Okay I've just worked out the issue. It was a bit of an oversight in the logic on my part. 89d2b77 should fix it.

Sorry for the annoyance guys.

[daltonrooney]

@jamesedmonston This seems to be working correctly now. I'm able to query the public API as well as use existing tokens with no problem. Thanks so much for the help!