Authentication errors in context in GraphQL - Mini Project: Build & Apply

Handling Authentication Errors in GraphQL Context

📖 Scenario: You are building a GraphQL API for a simple blog platform. Users must be authenticated to create posts. You want to handle authentication errors properly by using the GraphQL context to check if a user is logged in before allowing post creation.

🎯 Goal: Build a GraphQL schema and resolver setup that checks for user authentication in the context and returns an authentication error if the user is not logged in.

📋 What You'll Learn

Create a GraphQL schema with a Mutation type that has a createPost field accepting title and content arguments.

Add a context object that contains a user field representing the logged-in user or null if not logged in.

In the resolver for createPost, check if context.user exists; if not, throw an authentication error.

Return the created post object with id, title, content, and author fields.

💡 Why This Matters

🌍 Real World

Handling authentication errors in GraphQL APIs is essential for protecting sensitive operations like creating posts or accessing user data.

💼 Career

Understanding how to use context for authentication and error handling is a key skill for backend developers working with GraphQL.

1

Define the GraphQL schema with Post type and createPost mutation

Write the GraphQL schema defining a Post type with fields id, title, content, and author. Also define a Mutation type with a createPost field that accepts title and content as String! arguments and returns a Post.

GraphQL

# Define the GraphQL schema with Post type and createPost mutation
# Your code here

Hint

Define the Post type first, then add the createPost mutation with the correct arguments and return type.

2

Add context object with user field

In your GraphQL server setup, create a context object that includes a user field. Set user to null to simulate no logged-in user for now.

GraphQL

type Post {
  id: ID!
  title: String!
  content: String!
  author: String!
}

type Mutation {
  createPost(title: String!, content: String!): Post
}

const context = {
  // Your code here
}

Hint

Define a context object with a user property set to null.

3

Implement createPost resolver with authentication check

Write the resolver function for createPost that accepts parent, args, and context. Check if context.user is null. If so, throw an error with the message Authentication required. Otherwise, return a new post object with id set to "1", title and content from args, and author from context.user.

GraphQL

type Post {
  id: ID!
  title: String!
  content: String!
  author: String!
}

type Mutation {
  createPost(title: String!, content: String!): Post
}

const context = {
  user: null
}

const resolvers = {
  Mutation: {
    createPost(parent, args, context) {
      // Your code here
    }
  }
}

Hint

Check context.user and throw an error if missing. Otherwise, return the post object with the correct fields.

4

Set context user to simulate logged-in user

Modify the context object to set user to the string "Alice" to simulate a logged-in user named Alice.

GraphQL

type Post {
  id: ID!
  title: String!
  content: String!
  author: String!
}

type Mutation {
  createPost(title: String!, content: String!): Post
}

const context = {
  // Your code here
}

const resolvers = {
  Mutation: {
    createPost(parent, args, context) {
      if (!context.user) {
        throw new Error('Authentication required');
      }
      return {
        id: '1',
        title: args.title,
        content: args.content,
        author: context.user
      };
    }
  }
}

Hint

Set user in context to 'Alice'.

Practice

1. What is the main purpose of checking user information in the GraphQL context during a query?

easy

A. To prevent unauthorized users from accessing sensitive data

B. To speed up the query execution

C. To format the data before sending it

D. To log the query for analytics

Solution

1. Step 1: Understand the role of context in GraphQL

   The context carries user information that helps identify who is making the request.

2. Step 2: Recognize the purpose of authentication checks

   Checking user info in context ensures only authorized users get sensitive data.

3. Final Answer:

   To prevent unauthorized users from accessing sensitive data -> Option A

4. Quick Check:

   Authentication protects data = D [OK]

Hint: Always check user info in context to block unauthorized access [OK]

Common Mistakes:

• Thinking context is for speeding queries
• Assuming context formats data
• Believing context is only for logging

2. Which of the following is the correct way to throw an authentication error inside a GraphQL resolver using context?

easy

A. throw new Error('Not authenticated') without checking context

B. if (context.user) throw new Error('Not authenticated')

C. return 'Not authenticated' without throwing error

D. if (!context.user) throw new Error('Not authenticated')

Solution

1. Step 1: Check user presence in context

   We must verify if context.user exists to confirm authentication.

2. Step 2: Throw error when user is missing

   If no user info, throw an error to stop unauthorized access.

3. Final Answer:

   if (!context.user) throw new Error('Not authenticated') -> Option D

4. Quick Check:

   Throw error if no user = C [OK]

Hint: Throw error only when user info is missing in context [OK]

Common Mistakes:

• Throwing error when user exists
• Not checking context before throwing
• Returning error message instead of throwing

3. Given this resolver snippet:

function resolver(parent, args, context) {
  if (!context.user) {
    throw new Error('Not authenticated');
  }
  return 'Secret Data';
}

What will be the output if context.user is null?

medium

A. null

B. Error: Not authenticated

C. 'Secret Data'

D. undefined

Solution

1. Step 1: Check the condition with context.user null

   Since context.user is null, the condition !context.user is true.

2. Step 2: Understand error throwing behavior

   The resolver throws an error 'Not authenticated' and stops execution.

3. Final Answer:

   Error: Not authenticated -> Option B

4. Quick Check:

   Null user triggers error = A [OK]

Hint: Null or missing user causes error throw [OK]

Common Mistakes:

• Assuming it returns secret data anyway
• Expecting null instead of error
• Confusing error message with return value

4. Identify the error in this resolver code snippet:

function resolver(parent, args, context) {
  if (context.user === undefined) {
    throw new Error('Not authenticated');
  }
  return 'User data';
}

medium

A. Throwing error without message is wrong

B. Return statement is missing

C. It should check if context.user is falsy, not just undefined

D. No error, code is correct

Solution

1. Step 1: Analyze the user check condition

   The code only checks if context.user is exactly undefined, missing null or false cases.

2. Step 2: Explain why broader check is needed

   Users can be null or falsy; checking only undefined misses those cases, allowing unauthorized access.

3. Final Answer:

   It should check if context.user is falsy, not just undefined -> Option C

4. Quick Check:

   Check all falsy user values = B [OK]

Hint: Check all falsy user values, not just undefined [OK]

Common Mistakes:

• Checking only undefined misses null users
• Assuming error message is missing
• Thinking return is missing

5. You want to protect a GraphQL query that returns user profile data. Which approach correctly uses context to throw an authentication error only if the user is not logged in, and returns the profile otherwise?

function getUserProfile(parent, args, context) {
  // Your code here
}

hard

A. if (!context.user) throw new Error('Not authenticated'); return context.user.profile;

B. if (context.user) throw new Error('Not authenticated'); return context.user.profile;

C. return context.user.profile; if (!context.user) throw new Error('Not authenticated');

D. throw new Error('Not authenticated'); return context.user.profile;

Solution

1. Step 1: Check user presence before returning data

   The code must first verify if context.user exists to confirm authentication.

2. Step 2: Throw error if user is missing, else return profile

   If no user, throw error; otherwise, safely return user profile data.

3. Final Answer:

   if (!context.user) throw new Error('Not authenticated'); return context.user.profile; -> Option A

4. Quick Check:

   Check user first, then return profile = A [OK]

Hint: Check user before return; throw error if missing [OK]

Common Mistakes:

• Throwing error when user exists
• Returning before checking user
• Throwing error unconditionally