HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Forgetting that the context function runs on every single request, and doing expensive work inside it

// Wrong: does a full DB roundtrip on every request, even public queries
const contextFn = async ({ req }) => {
  const settings = await db.settings.findOne(); // expensive, runs every time
  return { user: await verifyJWT(req.headers.authorization), settings };
};

// Correct: only decode the token; let resolvers fetch what they actually need
const contextFn = async ({ req }) => ({
  user: await verifyJWT(req.headers.authorization),
  db
});

The Solution //

Since Apollo calls the context function fresh for every incoming HTTP request (not once at server startup), placing an expensive operation there — like re-parsing a large config file or making an unnecessary database round trip before knowing if the query even needs it — multiplies that cost by your request volume. Keep the context function limited to cheap, per-request necessities like verifying a JWT and returning lightweight references (a db client, not a fresh connection).

The Error //

Throwing a plain JavaScript Error instead of GraphQLError, losing structured error codes

// Wrong: client can't distinguish this from a real server crash
throw new Error('Not authorized');

// Correct: explicit, machine-readable error code
throw new GraphQLError('Not authorized', { extensions: { code: 'UNAUTHENTICATED' } });

The Solution //

throw new Error('Not authorized') reaches the client as a generic INTERNAL_SERVER_ERROR extension code, giving the frontend no reliable way to distinguish an auth failure from a genuine server bug. Use GraphQLError with an explicit extensions.code so clients can branch on error type (e.g. redirect to login on UNAUTHENTICATED) instead of string-matching the error message.