https://www.prisma.io/ logo
Join Slack
Powered by
How can I add a middleweare function to my graphql...
# orm-help
j
How can I add a middleweare function to my graphql yoga setup?
Copy code
function myMiddle(req, res, next) {
  next()
}

const server = new GraphQLServer({
  typeDefs: './src/schema.graphql',
  resolvers,
  middlewares: [myMiddle],
  context: req => ({
    ...req,
    db: new Prisma({
      typeDefs: 'src/generated/prisma.graphql', // the auto-generated GraphQL schema of the Prisma API
      endpoint: process.env.PRISMA_ENDPOINT, // the endpoint of the Prisma API (value set in `.env`)
      debug: true, // log all GraphQL queries & mutations sent to the Prisma API
      // secret: process.env.PRISMA_SECRET, // only needed if specified in `database/prisma.yml` (value set in `.env`)
    }),
  }),
});

server.start(() => console.log('Server is running on <http://localhost:4000'>));
c
Are you talking about Express middleware or Prisma middleware ?
j
Express, that’s why I was getting confused by the docs.
c
Because your middleware signature seems to be an Express middleware
j
Im going to validate a JWT token so I think this should be Express?
c
I am using Express middleware for this. And applying it like this: 
<http://server.express.post|server.express.post>(server.options.endpoint, checkJwt)
👍 1
a
express middleware is fine, unless you have to apply different rules to endpoints, or you have any public query/mutation
j
When I go to jwt.io im able to decode the token without any secrete. Does this mean that it’s not secure eg could the data be tampered with?
c
@Alessio I think that using jwt express middleware AND 
graphql-shield
is very powerful.
@Jim do you put any private information into token? Security depends on who can encode imo.
j
Nothing expect possibly an email address.
a
nice! I’ll give it a shot, thanks @CHaBou
c
@Jim where your token is encoded ? Something like auth0.com ?
j
Yes
Im using Auth0 to return a JWT. I can decode the JWT and see the user’s ID.
This seems to work fine. The only thing im concerned about is im not using a key / password to decode it, so I dont know if its tamper proof or not.
c
A JWT token is not really encoded. It is signed.
j
Right, so it’s still possible know know that the information is accurate? SO if the token contains a user ID then I can use this for authentication?
c
You have to check its signature to trust a token. (automatically done by libs)
You have to specify a 
jwksUri
or a key in your jwt lib. And signature is verified against this
So yes, you can trust your token and informations embedded in it (otherwise 
jwt
would be unuseful)
n
@Jim JWTs are not about hiding information, but about signing information. Don't use JWT to hide information, you can read them in clear text without a secret.
You need the secret to create a valid JWT, that's it.
4 Views
Open in Slack
PreviousNext
Powered by