Server middleware in GraphQL - Step-by-Step Execution

Concept Flow - Server middleware

Client sends GraphQL request

↓

Middleware intercepts request

↓

Modify request

↓

Forward to GraphQL resolver

↓

Resolver processes query

↓

Middleware intercepts response

↓

Modify response if needed

↓

Send response to client

The middleware sits between client and resolver, intercepting requests and responses to modify or check them.

Execution Sample

GraphQL

function middleware(request) {
  if (!request.auth) {
    throw new Error('Unauthorized');
  }
  request.headers['X-Trace'] = '123';
  const response = resolver(request);
  response.data.modified = true;
  return response;
}

This middleware checks authorization, adds a header, calls the resolver, modifies the response, then returns it.

Execution Table

Step	Action	Input State	Output State	Notes
1	Receive request	{ auth: false, headers: {} }	{ auth: false, headers: {} }	Initial request without auth
2	Check auth	auth: false	Error thrown	Authorization fails, error stops flow
3	Receive request	{ auth: true, headers: {} }	{ auth: true, headers: {} }	New request with auth
4	Add header	headers: {}	headers: { 'X-Trace': '123' }	Middleware adds tracing header
5	Call resolver	request with auth and header	response { data: { original: true } }	Resolver processes request
6	Modify response	response { data: { original: true } }	response { data: { original: true, modified: true } }	Middleware adds modified flag
7	Return response	response with modified data	response with modified data	Final response sent to client

💡 Execution stops early if auth check fails; otherwise, request flows through middleware and resolver.

Variable Tracker

Variable	Start	After Step 2	After Step 4	After Step 5	After Step 6	Final
request.auth	false/true	false (error) or true	true	true	true	true
request.headers	{}	{}	{ 'X-Trace': '123' }	{ 'X-Trace': '123' }	{ 'X-Trace': '123' }	{ 'X-Trace': '123' }
response.data	n/a	n/a	n/a	{ original: true }	{ original: true, modified: true }	{ original: true, modified: true }

Key Moments - 3 Insights

Why does the middleware throw an error and stop execution when auth is missing?

Because in step 2 of the execution table, the auth check fails and throws an error, preventing further steps.

How does the middleware modify the request before sending it to the resolver?

At step 4, the middleware adds a header 'X-Trace' to the request headers, as shown in the execution table.

What happens to the response after the resolver returns it?

At step 6, the middleware adds a 'modified: true' flag to the response data before returning it to the client.

Visual Quiz - 3 Questions

Look at the execution table, what happens at step 2 when auth is false?

A The middleware throws an error and stops execution

B The resolver processes the request

C The middleware adds a header

D The response is modified

💡 Hint

Check the 'Action' and 'Notes' columns for step 2 in the execution table.

At which step does the middleware add the 'X-Trace' header to the request?

A Step 1

B Step 3

C Step 4

D Step 6

💡 Hint

Look at the 'Action' and 'Output State' columns in the execution table for header changes.

If the auth check was removed, what would change in the execution table?

A Step 4 would be skipped

B Step 2 would no longer throw an error and execution would continue

C The resolver would not be called

D The response would not be modified

💡 Hint

Consider what happens at step 2 and how it affects the flow.

Concept Snapshot

Server middleware intercepts GraphQL requests and responses.
It can check authorization, modify requests, and change responses.
Middleware runs before and after resolvers.
Errors in middleware stop request processing.
Middleware helps add features like logging, auth, and tracing.

Full Transcript

Server middleware in GraphQL acts as a middle step between the client and the resolver. When a client sends a request, the middleware first checks if the request has authorization. If not, it throws an error and stops the process. If authorized, it can add extra information like headers to the request. Then it sends the request to the resolver, which processes the query and returns data. The middleware can then modify this response before sending it back to the client. This flow helps add security and extra features without changing the core resolver logic.