HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Trying to protect the whole schema with an Express auth middleware in front of /graphql

// Wrong: blocks login/register too
app.post('/graphql', authMiddleware, graphqlHandler);

// Correct: identify the user in context, let resolvers decide
const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: ({ req }) => ({ user: verifyToken(req.headers.authorization) })
});

The Solution //

Because GraphQL exposes a single POST endpoint, a blanket authMiddleware blocks public mutations like login and register along with everything else. Authentication must happen inside the Apollo context function (to extract and verify the user), while authorization is enforced per-resolver or via a schema directive — never as a route-level gate.

The Error //

Assuming a rejected field silently disappears instead of erroring the whole response

// Hides the field without failing the whole query
email: (parent, args, context) => {
  if (context.user?.role === 'ADMIN') return parent.email;
  return null; // field must be nullable in the schema
}

The Solution //

Throwing inside a nested resolver (e.g. the email field resolver) doesn't just null out that one field by default — GraphQL's error propagation bubbles a thrown error up and can null out the entire parent object unless the field is nullable. Return null for fields you want to hide from unauthorized users, and reserve throwing an AuthenticationError for top-level operations that should fail entirely.