hasura / hasura/graphql-engine

json array session variables in auth hook give parse error

Open
#10,107 2 comments 1 reaction 0 assignees View on GitHub
k/bug t/gql-services
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v2.36.1
CLI Version (for CLI related issue):

### Environment

OSS

### What is the current behaviour?

in our system we use auth hook to authenticate and authorize users the auth hook give a response like so:
```
{
"X-Hasura-role":"user",
"X-Hasura-User-Id":"d6630142-d77c-4241-b5c3-ff28374114d0",
"X-Hasura-Allowed-Ids":[
"test1",
"test2"
]
}
```
which means user has access to test1 and test2 group

### What is the expected behaviour?

when i do this hasura give this error
"event":{"detail":"Invalid response from authorization hook: Error in $['X-Hasura-Allowed-Ids']: parsing Text failed, expected String, but encountered Array","type":"conn_err"},"user_vars":null}

if i switch from list to {"test1","test2"} notation it will solve the issue but it is not a supported type in any language. i see a merge request [2475](https://github.com/hasura/graphql-engine/pull/2475) and [1799](https://github.com/hasura/graphql-engine/pull/1799) which state it is fixed and merged but it is not working correctly for me. is there any solution?

Contributor guide

Open the contributing guide

Research direction

Start at the auth hook response parsing path and reproduce the reported response containing an array in X-Hasura-Allowed-Ids. Review pull requests 2475 and 1799 to compare their intended behavior with the v2.36.1 result; the issue is done when supported JSON arrays are accepted without the parsing error.

Written by the indexing model from the issue text.

Assessment

Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.