3 ms·

Ok, but that’s true whether or not you use GQL.

withinboredom 3y ago
Sure. I could respond with a 4xx code because you’re not authorized for that field. Ah, but maybe you want to know which field? Too bad GQL doesn’t really support that.
- cameronh90 3y ago
  Authorization errors can go in the errors array which has a path reference in the standard. You generally don't want to use HTTP error codes with field level errors in GQL.
  - paulryanrogers 3y ago
    So still a 200? Or a 202, 206, 207?
    - troupo 3y ago
      401 or 403. Why is this a question?
      - paulryanrogers 3y ago
        Because there may be fields requested correctly alongside some requested incorrectly
        troupo 3y ago
        Outside of very few cases it means the request was incorrect. And bo one is stopping you from returning a response that contains error details.
- satvikpendem 3y ago
  GraphQL has strongly typed errors unlike REST. It is very akin to the Result type in many languages in that you are forced to handle errors even when writing the query, and the query will simply not compile if you don't. For example, the Pothos library implements this pattern automatically: type Error { message: String! } type Query { hello(name: String!): QueryHelloResult } union QueryHelloResult = Error | QueryHelloSuccess type QueryHelloSuccess { data: String! } This field can be queried using fragments like: query { hello(name: "World") { __typename ... on Error { message } ... on QueryHelloSuccess { data } } } https://pothos-graphql.dev/docs/plugins/errors https://pothos-graphql.dev/docs/plugins/errors
  - withinboredom 3y ago
    But now I’m most likely returning a 2xx response. There are asshole corporate middle boxes somewhere that will cache it. If I return a 4xx response, from experience (albeit nearly 5 years ago) I’ll crash your client. Now what? If someone has solved the asshole corporate middle box problem using GQL, that’s really good news.

Sure. I could respond with a 4xx code because you’re not authorized for that field. Ah, but maybe you want to know which field? Too bad GQL doesn’t really support that.

cameronh90 3y ago
Authorization errors can go in the errors array which has a path reference in the standard. You generally don't want to use HTTP error codes with field level errors in GQL.
- paulryanrogers 3y ago
  So still a 200? Or a 202, 206, 207?
  - troupo 3y ago
    401 or 403. Why is this a question?
    - paulryanrogers 3y ago
      Because there may be fields requested correctly alongside some requested incorrectly
      - troupo 3y ago
        Outside of very few cases it means the request was incorrect. And bo one is stopping you from returning a response that contains error details.
satvikpendem 3y ago
GraphQL has strongly typed errors unlike REST. It is very akin to the Result type in many languages in that you are forced to handle errors even when writing the query, and the query will simply not compile if you don't. For example, the Pothos library implements this pattern automatically: type Error { message: String! } type Query { hello(name: String!): QueryHelloResult } union QueryHelloResult = Error | QueryHelloSuccess type QueryHelloSuccess { data: String! } This field can be queried using fragments like: query { hello(name: "World") { __typename ... on Error { message } ... on QueryHelloSuccess { data } } } https://pothos-graphql.dev/docs/plugins/errors https://pothos-graphql.dev/docs/plugins/errors
- withinboredom 3y ago
  But now I’m most likely returning a 2xx response. There are asshole corporate middle boxes somewhere that will cache it. If I return a 4xx response, from experience (albeit nearly 5 years ago) I’ll crash your client. Now what? If someone has solved the asshole corporate middle box problem using GQL, that’s really good news.