Skip to content

July 18, 2024
Compare
Choose a tag to compare
@theguild-bot theguild-bot released this 18 Jul 05:58
· 77 commits to main since this release
release-1721282306424
855600c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

@graphql-yoga/[email protected]

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Major Changes

  • #3366
    057ad06
    Thanks @dotansimha! - Re-write for the JWT plugin. This plugin
    can be configured now with multiple providers, lookup locations, token verification, and more.

    The version has better version coverage, and it provides an improved API for configuring provider
    and custom behaviors.

    Breaking Change: New Plugin Configuration

    Signing key providers

    ❌ The signingKey option has be removed. ❌ The jwksUri + jwksOpts options has been removed.
    ✅ Multiple signing key providers and support for fallbacks (singingKeyProviders[]). ✅ Improved
    API for defining signing key configuration. ✅ Better defaults for caching and rate-limiting for
    remote JWKS providers.

    Before

    useJWT({
  signingKey: "...",
  // or
  jwksUri: "http://example.com/..."
  jwksOpts: {
    // ...
  }
})

    After

    import {
  createInlineSigningKeyProvider,
  createRemoteJwksSigningKeyProvider,
  useJWT
} from '@graphql-yoga/plugin-jwt'

useJWT({
  // Pass one or more providers
  singingKeyProviders: [
    createRemoteJwksSigningKeyProvider({
      // ...
    })
    // This one also acts as a fallback in case of a fetching issue with the 1st provider
    createInlineSigningKeyProvider({ signingKey: "..."})
  ]
})

    Improved Token Lookup

    ❌ Removed getToken option from the root config. ✅ Added support for autmatically extracting
    the JWT token from cookie or header. ✅ Easier setup for extracting from multiple locations. ✅
    getToken is still available for advanced use-cases, you can pass a custom function to
    lookupLocations.

    Before

    useJWT({
  getToken: payload => payload.request.headers.get('...')
})

    After

    With built-in extractors:

    imoprt { extractFromHeader, extractFromCookie, useJWT } from '@graphql-yoga/plugin-jwt'

const yoga = createYoga({
  // ...
  plugins: [
    useCookies(), // Required if "extractFromCookie" is used.
    useJWT({
      lookupLocations: [
        extractFromHeader({ name: 'authorization', prefix: 'Bearer' }),
        extractFromHeader({ name: 'x-legacy-auth' }),
        extractFromHeader({ name: 'x-api-key', prefix: 'API-Access' }),
        extractFromCookie({ name: 'browserAuth' })
      ]
    })
  ]
})

    With a custom getToken:

    useJWT({
  lookupLocations: [payload => payload.request.headers.get('...')]
})

    Improved Verification Options

    ❌ Removed root-level config algorithms + audience + issuer flags. ✅ Easy API for
    customizing token verifications (based on jsonwebtoken library). ✅ Better defaults for token
    algorithm verification (before: RS256, after: RS256 and HS256)

    Before

    useJWT({
  algorithms: ['RS256'],
  audience: 'my.app',
  issuer: 'http://my-issuer'
})

    After

    useJWT({
  tokenVerification: {
    algorithms: ['RS256', 'HS256'],
    audience: 'my.app',
    issuer: 'http://my-issuer'
    // You can pass more options to `jsonwebtoken.verify("...", options)` here
  }
})

    Customized Token Rejection

    ✅ New config flag reject: { ... } for configuring how to handle a missing or invalid tokens
    (enbaled by default).

    useJWT({
  reject: {
    missingToken: true,
    invalidToken: true
  }
})

    Flexible Context Injection

    ❌ Removed root-level config extendContextField flags. ✅ Added root-level config
    extendContext (boolean / string) ✅ Token and payload are injected now to the context
    (structure: { payload: {}, token: { value, prefix }})

    Before

    useJWT({
  reject: {
    extendContextField: true
  }
})

    After

    // Can be a boolean. By default injects to "context.jwt" field
useJWT({
  reject: {
    extendContext: true
  }
})

// Or an object to customize the field name
useJWT({
  reject: {
    extendContext: 'myJwt'
  }
})

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

@graphql-yoga/[email protected]

Patch Changes

Assets 2
Loading