@urql/exchange-auth

@urql/exchange-auth

An exchange for managing authentication in urql

@urql/exchange-auth is an exchange for the urql GraphQL client which helps handle auth headers and token refresh

Quick Start Guide

First install @urql/exchange-auth alongside urql:

yarn add @urql/exchange-auth
# or
npm install --save @urql/exchange-auth

You'll then need to add the authExchange, that this package exposes to your urql Client

import { createClient, dedupExchange, cacheExchange, fetchExchange } from 'urql';
import { makeOperation } from '@urql/core';
import { authExchange } from '@urql/exchange-auth';

const client = createClient({
  url: 'http://localhost:1234/graphql',
  exchanges: [
    dedupExchange,
    cacheExchange,
    authExchange({
      addAuthToOperation: ({
        authState,
        operation,
      }) => {
        // the token isn't in the auth state, return the operation without changes
        if (!authState || !authState.token) {
          return operation;
        }

        // fetchOptions can be a function (See Client API) but you can simplify this based on usage
        const fetchOptions =
          typeof operation.context.fetchOptions === 'function'
            ? operation.context.fetchOptions()
            : operation.context.fetchOptions || {};

        return makeOperation(
          operation.kind,
          operation,
          {
            ...operation.context,
            fetchOptions: {
              ...fetchOptions,
              headers: {
                ...fetchOptions.headers,
                "Authorization": authState.token,
              },
            },
          },
        );
      },
      willAuthError: ({ authState }) => {
        if (!authState) return true;
        // e.g. check for expiration, existence of auth etc
        return false;
      },
      didAuthError: ({ error }) => {
        // check if the error was an auth error (this can be implemented in various ways, e.g. 401 or a special error code)
        return error.graphQLErrors.some(
          e => e.extensions?.code === 'FORBIDDEN',
        );
      },
      getAuth: async ({ authState, mutate }) => {
        // for initial launch, fetch the auth state from storage (local storage, async storage etc)
        if (!authState) {
          const token = localStorage.getItem('token');
          const refreshToken = localStorage.getItem('refreshToken');
          if (token && refreshToken) {
            return { token, refreshToken };
          }
          return null;
        }

        /**
         * the following code gets executed when an auth error has occurred
         * we should refresh the token if possible and return a new auth state
         * If refresh fails, we should log out
         **/

        // if your refresh logic is in graphQL, you must use this mutate function to call it
        // if your refresh logic is a separate RESTful endpoint, use fetch or similar
        const result = await mutate(refreshMutation, {
          token: authState?.refreshToken,
        });

        if (result.data?.refreshLogin) {
          // save the new tokens in storage for next restart
          localStorage.setItem('token', result.data.refreshLogin.token);
          localStorage.setItem('refreshToken', result.data.refreshLogin.refreshToken);

          // return the new tokens
          return {
            token: result.data.refreshLogin.token,
            refreshToken: result.data.refreshLogin.refreshToken,
          };
        }

        // otherwise, if refresh fails, log clear storage and log out
        localStorage.clear();

        // your app logout logic should trigger here
        logout();

        return null;
      },
    }),
    fetchExchange
  ],
});

Handling Errors via the errorExchange

Handling the logout logic in getAuth is the easiest way to get started, but it means the errors will always get swallowed by the authExchange. If you want to handle errors globally, this can be done using the errorExchange:

import { errorExchange } from 'urql';

// this needs to be placed ABOVE the authExchange in the exchanges array, otherwise the auth error will show up hear before the auth exchange has had the chance to handle it
errorExchange({
  onError: (error) => {
    // we only get an auth error here when the auth exchange had attempted to refresh auth and getting an auth error again for the second time
    const isAuthError = error.graphQLErrors.some(
      e => e.extensions?.code === 'FORBIDDEN',
    );

    if (isAuthError) {
      // clear storage, log the user out etc
    }
  }
}),