Authentication errors in context in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Authentication Error Propagation

In a GraphQL API, when a user provides invalid credentials, how should the authentication error be handled in the resolver context to ensure the client receives a clear message?

A Throw an error inside the resolver without catching it, so the GraphQL server sends a generic error message.

B Return null from the resolver and log the error only on the server side without informing the client.

C Attach an authentication error to the context and throw a specific AuthenticationError that the client can catch and display.

D Ignore the error and return default data to avoid breaking the query.

💡 Hint

Think about how to communicate errors clearly to the client while maintaining security.

Throwing a specific AuthenticationError attached to the context allows the GraphQL server to send a clear, secure error message to the client. This helps the client understand the issue and respond appropriately.

❓ query_result

intermediate

Result of Query with Missing Authentication Token

Given a GraphQL query that requires authentication, what will be the result if the request is sent without an authentication token and the server uses context to check authentication?

GraphQL

query {
  userProfile {
    id
    name
  }
}

A {"errors":[{"message":"Internal server error"}],"data":null}

B {"data":{"userProfile":{"id":"123","name":"Alice"}}}

C {"data":{"userProfile":null}}

D {"errors":[{"message":"Authentication token missing","locations":[{"line":2,"column":3}],"path":["userProfile"]}],"data":{"userProfile":null}}

💡 Hint

Consider how GraphQL reports errors when authentication fails.

When authentication fails due to a missing token, the server returns an error message in the errors array and null for the data field requested.

📝 Syntax

advanced

Identify the Syntax Error in Authentication Middleware

Which option contains a syntax error in this GraphQL authentication middleware snippet that adds user info to context?

GraphQL

function context({ req }) {
  const token = req.headers.authorization || ''
  if (!token) {
    throw new AuthenticationError('No token')
  }
  const user = verifyToken(token)
  return { user }
}

A

function context({ req }) {
  const token = req.headers.authorization || ''
  if (!token) {
    throw new AuthenticationError('No token')
  }
  const user = verifyToken(token)
  return { user }
}

B

function context(req) {
  const token = req.headers.authorization || ''
  if (!token) {
    throw new AuthenticationError('No token')
  }
  const user = verifyToken(token)
  return { user }
}

C

function context({ req }) {
  const token = req.headers.authorization || ''
  if (!token) {
    throw new AuthenticationError('No token')
  }
  const user = verifyToken(token)
  return user
}

D

function context({ req }) {
  const token = req.headers.authorization || ''
  if (!token) {
    throw new AuthenticationError('No token')
  }
  const user = verifyToken(token)
  return { user: user }
}

💡 Hint

Check the function parameter syntax carefully.

Option B incorrectly uses req directly as a parameter without destructuring, but the function expects an object with a req property. This causes a runtime error when accessing req.headers.

❓ optimization

advanced

Optimizing Authentication Checks in GraphQL Context

Which option best optimizes authentication checks in the GraphQL context function to avoid redundant token verification on every resolver call?

A Verify the token once in the context function and attach the user info to context for all resolvers.

B Verify the token inside each resolver separately to keep context simple.

C Skip token verification and trust client-provided user info in context.

D Verify the token in a middleware before GraphQL execution and pass user info via context.

💡 Hint

Think about where to do the token verification for best performance and code clarity.

Verifying the token once in the context function and attaching user info avoids repeating verification in every resolver, improving performance and keeping code clean.

🔧 Debug

expert

Debugging Unexpected Authentication Error in Context

A GraphQL server returns an 'AuthenticationError: Invalid token' even when a valid token is sent. The context function is:

function context({ req }) {
  const token = req.headers.authorization.split(' ')[1]
  const user = verifyToken(token)
  return { user }
}

What is the most likely cause of the error?

A The token is being split incorrectly because the authorization header is undefined or empty.

B The verifyToken function is not imported correctly, causing it to always throw an error.

C The authorization header is missing the 'Bearer' prefix, causing split to fail.

D The context function does not return the user object properly.

💡 Hint

Check how the token is extracted from the authorization header.

If the authorization header is missing or empty, calling split(' ')[1] causes an error or undefined token, leading verifyToken to throw an 'Invalid token' error.