99designs / 99designs/gqlgen

Incorrect note in authentication recipe doc

Open
#2,474 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
10.8k
Forks
1.3k
Avg merge
2d 36m
Merged PRs (30d)
26

Description

Hello!

From [authentication recipe](https://gqlgen.com/recipes/authentication/):

> Subscriptions are long lived, if your tokens can timeout or need to be refreshed you should keep the token in context too and verify it is still valid in `auth.ForContext`.

This seems incorrect. If I'm not wrong, once the subscription has been set then there is no way to call `auth.ForContext` from the subscriber's context. And as rightly pointed out by that note - subscriptions are long lived. So the token could expire meanwhile and subscription would have no way to know that.

Fortunately, @RobinCPel has pushed the code to close websocket when context is done/cancelled. So we can use `context.WithDeadline` as [suggested](https://github.com/99designs/gqlgen/issues/774#issuecomment-980033736) by them:
```go
func WebsocketAuthInitFunc(ctx context.Context, initPayload transport.InitPayload) (context.Context, error) {
...
newCtx, _ := context.WithDeadline(transport.AppendCloseReason(ctx, "authentication token has expired"), time.Unix(token.ExpiresAt, 0))
return newCtx, nil
}
```

Let's add that to the authentication recipe code and remove above note. (I'm also interested in knowing how to discard the cancel function and silence the vet)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.