Spring SecurityContext and graphql-java

[eriklagerholm]

Hi! We're running a spring boot and graphql-java setup with the following frameworks:

<dependency>
  <groupId>com.graphql-java</groupId>
  <artifactId>graphql-java</artifactId>
  <version>16.2</version>
</dependency>
<dependency>
  <groupId>com.graphql-java-kickstart</groupId>
  <artifactId>graphql-java-tools</artifactId>
  <version>11.0.0</version>
</dependency>
<dependency>
  <groupId>com.graphql-java-kickstart</groupId>
  <artifactId>graphql-java-servlet</artifactId>
  <version>11.1.0</version>
</dependency>

We recently upgraded from graphql-java 13, tools 5.6 and servlet 9.2 to the above versions. As I understand it there is new async defaults for datafetchers and as such we have got issues with the Spring SecurityContext not being passed between threads. We have dataloaders from before the upgrade that are running with the context just fine, on their own executor that we previously set up to pass the context between threads. But the new async datafetchers we're struggling to get the Context passed consistently.

I wonder if anyone in the community has a similar setup to ours and got the async bit and context working properly? Or are most people running the graphql-spring-boot-starter that perhaps solves this out-the-box?

We would be very thankful for any input on this topic!

[oliemansm]

If you're using those three libs, then why wouldn't you just use graphql-spring-boot-starter as you also mention? That should reduce a lot of boilerplate code on your end and probably solves this problem too. I'm using that starter in various projects with spring security without the problem you're facing.

[tmarsteel]

@eriklagerholm did this work for you? I'm having a similar problem. No Spring, but same root cause.

[eriklagerholm]

@tmarsteel We went a different route, using the DataFetchingEnvironment to provide context-data to our async resolvers/fetchers.