node.jsexpressjwtgraphqlpostgraphql

Not allowed to secure GraphQL endpoint with JWT token

I'm running an express server and just put up JWT protection on my endpoints. I was testing out my /graphql endpoint and I am receiving a 403 Not allowed to provide a JWT token error. My other endpoints work fine, so I don't believe it is an issue with the JWT signing or verification. Any ideas?

var jwt = require('express-jwt');

var app = express();

var jwtCheck = jwt({
   secret: new Buffer(config.secret, 'base64'),
   audience: aud,
   issuer: iss
});

// enforce on all endpoints
app.use(jwtCheck);

app.use('/', postgraphql(config.db_string, config.db_schema, {
    development: true,
    log: true,
    secret: config.secret,
    graphiql: true,
}));

Postman Request landing on a vanilla graphql endpoint

Solution

  • Figured it out, problem was with not passing the correct parameters to PostgraphQL. If you pass a JWT token in the Authorization header to PostgraphQL, it expects a secret. If the secret does not exist, then PostgraphQL will throw the error 403 Not allowed to provide a JWT error.