Authentication errors in context in GraphQL - Step-by-Step Execution

Concept Flow - Authentication errors in context

Client sends GraphQL request

↓

Server receives request

↓

Check authentication token

↓

Process request

↓

Return data

↓

Client receives response

The server checks the authentication token in the request. If valid, it processes the query; if not, it returns an authentication error inside the response context.

Execution Sample

GraphQL

query GetUserData {
  user {
    id
    name
  }
}
# Server checks auth token in context

This query requests user data; the server verifies authentication before returning data or an error.

Execution Table

Step	Action	Authentication Token Present?	Result	Response Sent
1	Receive GraphQL request	Yes	Proceed to validate token	No response yet
2	Validate token	Valid	Token accepted	No response yet
3	Execute resolver for 'user'	N/A	Fetch user data	No response yet
4	Return user data	N/A	Data ready	{"data":{"user":{"id":"123","name":"Alice"}}}
5	Client receives response	N/A	Success	User data received
6	Receive GraphQL request	No	No token found	No response yet
7	Create authentication error	Invalid	Error created	No response yet
8	Return error in context	N/A	Error sent	{"errors":[{"message":"Authentication required"}]}
9	Client receives response	N/A	Failure	Authentication error received

💡 Execution stops after sending either user data or authentication error response.

Variable Tracker

Variable	Start	After Step 2	After Step 4	After Step 8	Final
authToken	null	"valid-token"	"valid-token"	null	null
response	null	null	{"data":{"user":{"id":"123","name":"Alice"}}}	{"errors":[{"message":"Authentication required"}]}	sent to client

Key Moments - 2 Insights

Why does the server return an error instead of data when the token is missing?

Because the authentication token is required to verify the user's identity. As shown in execution_table rows 6-8, without a valid token, the server creates and returns an authentication error.

Is the error returned inside the data field or a separate errors field?

The error is returned in a separate 'errors' field, not inside 'data'. This is shown in execution_table row 8 where the response contains an 'errors' array with the authentication message.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the server send user data back to the client?

A Step 6

B Step 8

C Step 4

D Step 2

💡 Hint

Check the 'Response Sent' column for the step where user data JSON is returned.

According to variable_tracker, what is the value of authToken after step 8?

A null

B "valid-token"

C "invalid-token"

D undefined

💡 Hint

Look at the 'authToken' row under 'After Step 8' in variable_tracker.

If the client sends a valid token, which response will the client NOT receive?

A User data with id and name

B Authentication error message

C Data field with user info

D Successful query result

💡 Hint

Refer to execution_table steps 1-5 where valid token leads to data, not error.

Concept Snapshot

Authentication errors in GraphQL context:
- Server checks auth token on each request
- If token missing or invalid, return error in 'errors' field
- If valid, execute query and return data
- Errors and data are separate fields in response
- Client must handle both success and error responses

Full Transcript

When a GraphQL request arrives, the server first checks if an authentication token is present. If the token is valid, the server processes the query and returns the requested data inside the 'data' field. If the token is missing or invalid, the server does not process the query but instead returns an authentication error inside the 'errors' field of the response. This flow ensures that only authenticated users can access protected data. The client must be prepared to handle both successful data responses and error messages. The execution table shows the step-by-step process, including token validation, data fetching, and error creation. The variable tracker shows how the authentication token and response change during execution. Understanding this flow helps beginners see how authentication errors are handled in GraphQL context.

Practice

1. What is the main purpose of checking user information in the GraphQL context during a query?

easy

A. To prevent unauthorized users from accessing sensitive data

B. To speed up the query execution

C. To format the data before sending it

D. To log the query for analytics

Solution

1. Step 1: Understand the role of context in GraphQL

   The context carries user information that helps identify who is making the request.

2. Step 2: Recognize the purpose of authentication checks

   Checking user info in context ensures only authorized users get sensitive data.

3. Final Answer:

   To prevent unauthorized users from accessing sensitive data -> Option A

4. Quick Check:

   Authentication protects data = D [OK]

Hint: Always check user info in context to block unauthorized access [OK]

Common Mistakes:

• Thinking context is for speeding queries
• Assuming context formats data
• Believing context is only for logging

2. Which of the following is the correct way to throw an authentication error inside a GraphQL resolver using context?

easy

A. throw new Error('Not authenticated') without checking context

B. if (context.user) throw new Error('Not authenticated')

C. return 'Not authenticated' without throwing error

D. if (!context.user) throw new Error('Not authenticated')

Solution

1. Step 1: Check user presence in context

   We must verify if context.user exists to confirm authentication.

2. Step 2: Throw error when user is missing

   If no user info, throw an error to stop unauthorized access.

3. Final Answer:

   if (!context.user) throw new Error('Not authenticated') -> Option D

4. Quick Check:

   Throw error if no user = C [OK]

Hint: Throw error only when user info is missing in context [OK]

Common Mistakes:

• Throwing error when user exists
• Not checking context before throwing
• Returning error message instead of throwing

3. Given this resolver snippet:

function resolver(parent, args, context) {
  if (!context.user) {
    throw new Error('Not authenticated');
  }
  return 'Secret Data';
}

What will be the output if context.user is null?

medium

A. null

B. Error: Not authenticated

C. 'Secret Data'

D. undefined

Solution

1. Step 1: Check the condition with context.user null

   Since context.user is null, the condition !context.user is true.

2. Step 2: Understand error throwing behavior

   The resolver throws an error 'Not authenticated' and stops execution.

3. Final Answer:

   Error: Not authenticated -> Option B

4. Quick Check:

   Null user triggers error = A [OK]

Hint: Null or missing user causes error throw [OK]

Common Mistakes:

• Assuming it returns secret data anyway
• Expecting null instead of error
• Confusing error message with return value

4. Identify the error in this resolver code snippet:

function resolver(parent, args, context) {
  if (context.user === undefined) {
    throw new Error('Not authenticated');
  }
  return 'User data';
}

medium

A. Throwing error without message is wrong

B. Return statement is missing

C. It should check if context.user is falsy, not just undefined

D. No error, code is correct

Solution

1. Step 1: Analyze the user check condition

   The code only checks if context.user is exactly undefined, missing null or false cases.

2. Step 2: Explain why broader check is needed

   Users can be null or falsy; checking only undefined misses those cases, allowing unauthorized access.

3. Final Answer:

   It should check if context.user is falsy, not just undefined -> Option C

4. Quick Check:

   Check all falsy user values = B [OK]

Hint: Check all falsy user values, not just undefined [OK]

Common Mistakes:

• Checking only undefined misses null users
• Assuming error message is missing
• Thinking return is missing

5. You want to protect a GraphQL query that returns user profile data. Which approach correctly uses context to throw an authentication error only if the user is not logged in, and returns the profile otherwise?

function getUserProfile(parent, args, context) {
  // Your code here
}

hard

A. if (!context.user) throw new Error('Not authenticated'); return context.user.profile;

B. if (context.user) throw new Error('Not authenticated'); return context.user.profile;

C. return context.user.profile; if (!context.user) throw new Error('Not authenticated');

D. throw new Error('Not authenticated'); return context.user.profile;

Solution

1. Step 1: Check user presence before returning data

   The code must first verify if context.user exists to confirm authentication.

2. Step 2: Throw error if user is missing, else return profile

   If no user, throw error; otherwise, safely return user profile data.

3. Final Answer:

   if (!context.user) throw new Error('Not authenticated'); return context.user.profile; -> Option A

4. Quick Check:

   Check user first, then return profile = A [OK]

Hint: Check user before return; throw error if missing [OK]

Common Mistakes:

• Throwing error when user exists
• Returning before checking user
• Throwing error unconditionally