GraphQL endpoints are not protected by the global Guards.

[lucassith]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

When you register GraphQL module with ApolloServer, Guards are not launched against Playground endpoints.

Minimum reproduction code

https://github.com/nestjs/nest/tree/master/sample/12-graphql-schema-first

Steps to reproduce

You can use your own code from samples.

1. npm install --force
2. Change main.js to (add dummy guard):

import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import {
  CanActivate,
  ExecutionContext,
  Injectable,
  Logger,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';


@Injectable()
export class TestGuard implements CanActivate {
  public canActivate(context: ExecutionContext): boolean {
    const ctx = GqlExecutionContext.create(context);
    Logger.verbose('guard text');
    return true;
  }
}

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.useGlobalGuards(new TestGuard());
  app.useGlobalPipes(new ValidationPipe());

  await app.listen(3000);
  console.log(`Application is running on: ${await app.getUrl()}`);
}
bootstrap();

3. npm start
4. Run localhost:3000/graphql

There will be no 'guard text' printed when you enter Playground nor when you call query.

Expected behavior

The playground endpoint is really secondary problem, the worst case here is that the endpoint for requesting the whole data is not guarded at all.

So you can POST /graphql with any query without any authorization.

Package version

12.0.9

Graphql version

graphql: 16.8.1
"@apollo/server": "^4.9.4",
"@nestjs/apollo": "^12.0.11",

NestJS version

16.8.1

Node.js version

10.3.1

In which operating systems have you tested?

• macOS
• Windows
• Linux

Other

Tried to get some help on Discord:
(https://discord.com/channels/520622812742811698/1025199348096700476/threads/1199825254697148457)

[lucassith]

Tried the same with middlewares and interceptors.

Middlewares do work as intended.
Interceptors are not called though.

I guess these requests to /graphql are omitting NestJS logic.

[kamilmysliwiec]

nestjs/nest#13098 (comment)