graphql/yoga-server/docs/features/jwt

[giscus[bot]]

graphql/yoga-server/docs/features/jwt

Learn how to add support for JWT authentication.

https://the-guild.dev/graphql/yoga-server/docs/features/jwt

[enri90]

in context I can't see jwt what can I do?

createYoga({
  plugins: [
    useJWT({
        issuer: 'http://graphql-yoga.com',
        signingKey,
    }),
  ],
  context: async (ctx) => {
      console.log('jwt:', ctx.jwt);  <-- Property 'jwt' does not exist in type 'YogaInitialContext'
}
})

[EmrysMyrddin]

Yes, the context function runs before all plugins. This means that any context field provided by another plugin can't be found. The jwt field will be available in the ctx in your resolvers :-)

If you really need to access the JWT from the context builder, you can use the useExtendContext plugin, which does pretty much the same thing but gives you the flexibility to order your plugins.

import { createYoga, useExtendContext } from 'graphql-yoga'
import { useJWT } from '@graphql-yoga/plugin-jwt'

createYoga({
  plugins: [
    useJWT({
        issuer: 'http://graphql-yoga.com',
        signingKey,
    }),
    useExtendContext(async ctx => {
       console.log('jwt:', ctx.jwt);
    }
  ],
})

[bgentry]

Thanks to this comment I discovered this workaround! What I had done previously with my local fork of useJWT is store the jwt on the extended Request type, similar to what useCookies does.

@EmrysMyrddin I feel like it has to be a pretty common use case to want to use the decoded/verified JWT as part of context loading (for getting a current user). Wondering if you have any thoughts on this or ideas for how to add this functionality to useJWT in a satisfactory way?

[EmrysMyrddin]

I see your point here, but I'm not sure how we could take over this.

Perhaps this is only a documentation issue. In my point of view, one should always use at least useExtendContext plugin to add something to the context.

The context config of Yoga is here to customize the base object that will be use as a context by plugins and GraphQL execution pipeline. So it is expected that the context is pretty much empty at this stage, it only contains HTTP layer data (the raw HTTP request and the parsed GraphQL query params) which are computed before the actual GraphQL execution pipeline begins.

I can also recommend you useGenericAuth which allows you to define how the user should be derived from the graphql context :-) You can (but doesn't need to) also take advantage of the very authorization checking capabilities of the plugin if they suite your needs.

[delfws]

@graphql-yoga/plugin-jwt, This plugin requires setting algorithms, if you are not using RS256.Followed the document but failed verification. It's really confusing.

[EmrysMyrddin]

Hi! Thank you for reaching out, do you have some reproduction code I can investigate to help you?

[enri90]

How can I set up various audiences? an authentication system based on the origin of the request

site.test.com
site2.test.com
api.test.com

    useJWT({
      algorithms: ['HS256'],
      audience: ['site.test.com','site2.test.com'],
      issuer: 'api.test.com',
      signingKey: 'test' ,
    }),

I would like the jwt to be valid based on the frontend domain

[EmrysMyrddin]

Hi! Sorry for the late reply here.

It appears our types are misleading and represents only a subset of the verification possibilities. In fact, you can pass any options supported by jsonwebtoken.verify.

I've created a PR to update the types, it should be merged soon: #3275

[claudianus]

plugins doesn't work on cloudflare workers :(

[EmrysMyrddin]

Hi! Can you open an issue about this? With the error stack trace and even if possible a reproduction case ?

[JakeBent]

Not sure if this has been pointed out, but the first property for useJWT is mispelled.

const yoga = createYoga({
  schema: mySchema, // Provide your GraphQL schema
  plugins: [
    useJWT({
      // Configure your signing providers: either a local signing-key or a remote JWKS are supported.
      singingKeyProviders: [ // <<-------------------------------------------------- singing? or should this be signing?
        createInlineSigningKeyProvider(signingKey),
        createRemoteJwksSigningKeyProvider({ jwksUri: 'https://example.com/.well-known/jwks.json' })
      ]

[ardatan]

See here;
#3422 (comment)