Graphql error after upgrade to RW 7

jwwisgerhof · March 21, 2024, 3:22am

I am getting the following error after upgrading to RW 7.x (tried 7.1.3 and latest RC):

{
“level”: 50,
“time”: 1710989863419,
“pid”: 8,
“hostname”: “xxxxxxxx”,
“name”: “graphql-server”,
“msg”: “Error building context. Error: Exception in getAuthenticationContext: The Authorization header is not valid.”
}
{
“level”: 50,
“time”: 1710989863419,
“pid”: 8,
“hostname”: “xxxxxxx”,
“err”: {
“type”: “Error”,
“message”: “Exception in getAuthenticationContext: The Authorization header is not valid.”,
“stack”: “Error: Exception in getAuthenticationContext: The Authorization header is not valid.\n at onContextBuilding (/var/task/node_modules/@redwoodjs/graphql-server/dist/plugins/useRedwoodAuthContext.js:37:15)\n at async Object.contextFactory (/var/task/node_modules/@envelop/core/cjs/orchestrator.js:206:45)\n at async processRequest (/var/task/node_modules/graphql-yoga/cjs/process-request.js:46:26)\n at async YogaServer.getResultForParams (/var/task/node_modules/graphql-yoga/cjs/server.js:269:26)\n at async handle (/var/task/node_modules/graphql-yoga/cjs/server.js:324:25)\n at async handlerFn (/var/task/node_modules/@redwoodjs/graphql-server/dist/functions/graphql.js:86:24)\n at async execFn (/var/task/node_modules/@redwoodjs/graphql-server/dist/functions/graphql.js:125:16)”
},
“msg”: “Exception in getAuthenticationContext: The Authorization header is not valid.”
}

We use a custom auth through a separate auth function. Have confirmed that that is working correclty and the output from that function is exactly the same between 6.6.4 and 7.x.

Works perfectly in dev. Downgrading to 6.6.4 (but keeping node 20 etc) fixes the issue. How do I go about even debugging this?

jwwisgerhof · March 21, 2024, 3:23am

I should add - I have confirmed that the right headers are being pushed through to the graphql route. Authorization and auth-provider are set up correctly (no difference between 6.6.4 and 7.x instances).

nivivive · April 10, 2024, 10:10pm

We have the same issue as well.

It looks like only ‘authorization’ (no capital A) works as a part of this change - feat(dbAuth): Refactor dbAuthHandler to support WebAPI Request events… · redwoodjs/redwood@765f585 · GitHub

I was able to test hitting the API with the bearer token passed into lowercase ‘authorization’ request header and it worked.

The Redwood team is aware of the issue currently and should be making a patch available soon.

dthyresson · April 11, 2024, 12:03pm

Hi @nivivive and @jwwisgerhof - thanks for reporting and apologies for the lateness of this fix but we have a PR approved and merged that will correct this behavior:

github.com/redwoodjs/redwood

fix(auth): Handle when authorization header is lowercased

redwoodjs:main ← dac09:fix/authorization-header-parsing

opened 10:20AM - 11 Apr 24 UTC

dac09

+73 -1

In one of the PRs I did for last release, I switched getting the header using t…he new `getEventHeaders` function. This function will check for two cases: ``` getEventHeaders('Authorization') => a) header['authorization'] b) header['Authorization'] ``` **BUT** if you passed it a lowercase header in the first place: ``` getEventHeaders('authorization') => a) header['authorization'] b) header['authorization'] ``` I actually didn't change the logic it's the same as before, but in`parseAuthorizationHeader`, we used to call it with the capital case. I know the _full_ solution is to grab the headers, and convert them all to lower-case, but I'm intentionally avoiding this because I don't want to slow down handling of every request by looping over all the headers. --- This PR makes a minor change, and adds some extra tests. 🤞 we'll move everything to Fetch API soon and won't have to deal with this sillyness!

We’ll work to get a patch out soon and will update here.

Cheers.

QuinnsCode · April 18, 2024, 6:01pm

I hit this error as well I think.

I’m trying to narrow it down, but I actually didn’t update RW.

I just started getting Authentication errors on a recent code push to Vercel.

I rolled back and forward and back the recent changes I made there and it’s not seeming to matter.

It looks like it’s coming through on the node modules whenever the build cache was refreshed on Vercel’s side on the code push which is why it did it to me on not a RW upgrade

Update 04/19: things are working now. Trying to change versions around 7 did not work for helping this. It just seems that a later code push eventually pulled a newer version of RW from npm (one where I did not update RW or change RW versions).