Optionally support CSRF tokens in GraphiQL page about absinthe_plug HOT 10 CLOSED

Does the GraphiQL JS have a built in way to specify default header values?

from absinthe_plug.

GraphiQL workspace has it:

https://github.com/OlegIlyenko/graphiql-workspace/blob/f798c7e4a122de0e4595917c4bdf90df5edf324c/src/config.js#L87

from absinthe_plug.

@petejkim I think it's probably a reasonable request. Note, though, given our work on the 1.3 release and prep for ElixirConf EU, the quickest way to get this done is going to be a contributed PR -- at least for several weeks. Anything submitted would have to avoid adding additional dependencies.

from absinthe_plug.

Sounds good, I will take a crack at it.

from absinthe_plug.

Another thing to mention; we really, really want to avoid forking GraphiQL "Classic" and GraphiQL Workspace, for maintenance reasons -- at the moment we merely point to those projects via CDN, and would like that to continue. So make sure anything you do via JS is hooking into those projects as-is.

from absinthe_plug.

from absinthe_plug.

I think the best route here is to permit an option to the graphiql plug called default headers, rather than handle just this specific header

I am not sure if it'd be possible to reference the CSRF token from router.ex though...

How about something like:

forward "/graphiql",
  Absinthe.Plug.GraphiQL,
  schema: MyApp.Schema,
  include_csrf_header: true

or it could be a special atom this Plug recognizes, something like:

forward "/graphiql",
  Absinthe.Plug.GraphiQL,
  schema: MyApp.Schema,
  default_headers: %{
    "X-Something" => "something",
    "X-CSRF-Token" => :csrf_token
  }

from absinthe_plug.

Actually, I think something like the following would be the best:

forward "/graphiql",
  Absinthe.Plug.GraphiQL,
  schema: MyApp.Schema,
  default_headers: %{
    "X-Something" => "something",
    "X-CSRF-Token" => {Plug.CSRFProtection, :get_csrf_token}
  }

What do you think?

from absinthe_plug.

Perhaps the whole config for headers should be a function:

default_headers: {__MODULE__, :graphiql_headers}

def graphical_headers() do
  %{"blah" => "foo"}
end

Alternatively we configure it like we do the context, where you have a plug that runs prior to the GraphiQL plug and it sets a value on the conn. This has the benefit of being trivially able to use incoming conn properties to set the default headers as desired.

Thoughts?

from absinthe_plug.

I went with the first approach you suggested: #77

from absinthe_plug.