Ability for server to reject connection with custom reason

[Amareis]

Story

As a server developer I want to reject connection with custom reason, based on connection params. e.g. user sends expected api version or app token, and I want to reject with "UpgradeNeeded" or "InvalidToken" reason.

Acceptance criteria

• server is able to reject user connection with custom reason (return string from onConnect?.. Not sure about code, maybe also it worth return [number, string] for custom code).
• client is able to handle it properly (already possible with closed callback).

[Amareis]

Or, maybe it's better to throw special error? And then error.message will be close reason and (optional) error.code will be close code. I think it's even better than handle return value.

[Amareis]

Ohh, I see, after #64 is merged, it can be really done in userland, great!

[enisdenjo]

Hey hey, great insight!

I recently updated the Protocol to be more allowing in the aspect of authentication. Close socket with code and reason, authenticate before WS upgrade, authenticate on subscribe - the Protocol does not care.

Exactly, you found the correct PR! With #64 you literally implement your own server. The lib will only give you the minimal controls to transport GraphQL as per the spec; so yeah, once #64 lands - you have the total power of controlling the authentication flow.

[Amareis]

Where is updated protocol? I can't see it on master nor in #64

[enisdenjo]

The updated Protocol is the one on master! Adjustment was made 18 days ago, here: fb2ab09.

Was just pointing out that you can still be spec compliant and authenticate however you want.

[Amareis]

Oh, just there is still code-reason pairs, so it's similar like they really enforced by spec.

[enisdenjo]

Yes, and those will stay. They are tightly related to the spec itself and I'd like them to be enforced.

However, you may close the socket however you want for any other logic outside of the spec (like auth).

[Amareis]

What if I close socket in onConnect handler? Will it work properly?

[enisdenjo]

Of course! You can close the socket quite literally whenever you want. The client will behave accordingly.

[enisdenjo]

🎉 This issue has been resolved in version 2.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[enisdenjo]

Hey @Amareis, as you may noticed, #64 has been released! This is how you'd go by implementing your own auth error handling:

// check extended implementation at `{ useServer } from 'graphql-ws/lib/use/ws'`

import http from 'http';
import ws from 'ws'; // yarn add ws
import { makeServer } from '../index';
import { execute, subscribe } from 'graphql';
import { schema } from 'my-graphql-schema';
import { validate } from 'my-auth';

// extra in the context
interface Extra {
  readonly request: http.IncomingMessage;
}

// your custom auth
class Forbidden extends Error {}
function handleAuth(request: http.IncomingMessage) {
  // do your auth on every subscription connect
  const good = validate(request.headers['authorization']);
  // or const { iDontApprove } = session(request.cookies);
  if (!good) {
    // throw a custom error to be handled
    throw new Forbidden(':(');
  }
}

// make
const server = makeServer<Extra>({
  schema,
  execute,
  subscribe,
  onConnect: async (ctx) => {
    // do your auth on every connect
    await handleAuth(ctx.extra.request);
  },
  onSubscribe: async (ctx) => {
    // or maybe on every subscribe
    await handleAuth(ctx.extra.request);
  },
  onNext: async (ctx) => {
    // haha why not on every result emission?
    await handleAuth(ctx.extra.request);
  },
});

// create websocket server
const wsServer = new ws.Server({
  server,
  path: '/graphql',
});

// implement
wsServer.on('connection', (socket, request) => {
  // pass the connection to graphql-ws
  const closed = server.opened(
    {
      protocol: socket.protocol, // will be validated
      send: (data) =>
        new Promise((resolve, reject) => {
          // control your data flow by timing the promise resolve
          socket.send(data, (err) => (err ? reject(err) : resolve()));
        }),
      close: (code, reason) => socket.close(code, reason), // for standard closures
      onMessage: (cb) => {
        socket.on('message', async (event) => {
          try {
            // wait for the the operation to complete
            // - if init message, waits for connect
            // - if query/mutation, waits for result
            // - if subscription, waits for complete
            await cb(event.toString());
          } catch (err) {
            // all errors that could be thrown during the
            // execution of operations, will be caught here
            if (err instanceof Forbidden) {
              // your magic
            } else {
              socket.close(1011, err.message);
            }
          }
        });
      },
    },
    // pass request to the extra
    { request },
  );

  // notify server that the socket closed
  socket.once('close', () => closed());
});

[Amareis]

Thank you!