
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
graphql-error-tracking-extension
Advanced tools
GraphQL server extension to track requests with errors
This GraphQL extension for Apollo Server 2 adds two functionalities:
Example log using this extension:
[dded97442947d] {"content-type":"application/json","cache-control":"no-cache","postman-token":"c824faa8-0287-406a-b326-bdbb173ee30d","authorization":"***","user-agent":"PostmanRuntime/7.6.0","accept":"*/*","host":"localhost:8080","accept-encoding":"gzip, deflate","content-length":"103","connection":"keep-alive"}
[dded97442947d] Syntax Error: Expected Name, found {
[dded97442947d] Original error body: query {getSetting(settingsId:"123", language: "en") { features { {onPremises} }}
In this case you can easily see that the Exception was just caused by a syntax error. However, if you need to find a real bug the corresponding query can be crucial.
graphql-extensions to be installed: npm i graphql-extensions --savenpm i graphql-error-tracking-extension --saveimport {ApolloServer} from 'apollo-server-express';
import {GraphQLErrorTrackingExtension} from 'graphql-error-tracking-extension';
const server = new ApolloServer({
schema,
extensions: [() => new GraphQLErrorTrackingExtension()],
context: ({req}) => ({
request: req
})
});
The GraphQLErrorTrackingExtension class takes an optional
configuration object new GraphQLErrorTrackingExtension(config).
Replaces http headers with sensitive information with '***'.
Default: ['authorization']
Define which error types (classes) should be revealed to the client. Default is to reveal all original errors to the client. If you set this option, all errors not in the list will be mapped to an Internal Server Error before sending a response to the client. Also have a look to the already available error types defined by Apollo Server 2 link.
Default: null
Example
import {ApolloServer, SyntaxError, UserInputError, AuthenticationError, ForbiddenError} from 'apollo-server-express';
import {GraphQLErrorTrackingExtension} from 'graphql-error-tracking-extension';
const server = new ApolloServer({
schema,
extensions: [() => new GraphQLErrorTrackingExtension({
revealErrorTypes: [SyntaxError, UserInputError, AuthenticationError, ForbiddenError]
})],
context: ({req}) => ({
request: req
})
});
Important: the array takes the JS classes, not strings!
If you have defined revealErrorTypes, this callback gets called if an error was mapped to Internal Server Error.
Whatever you do in this callback, the Internal Server Error is send to the client, but you can use it to e.g. forward
this unexpected error to another monitoring system.
Default: null
Example
import {ApolloServer, SyntaxError, UserInputError, AuthenticationError, ForbiddenError} from 'apollo-server-express';
import {GraphQLErrorTrackingExtension} from 'graphql-error-tracking-extension';
import {ErrorReporting} from '@google-cloud/error-reporting';
const errorReporting = new ErrorReporting();
const server = new ApolloServer({
schema,
extensions: [() => new GraphQLErrorTrackingExtension({
revealErrorTypes: [SyntaxError, UserInputError, AuthenticationError, ForbiddenError],
onUnrevealedError: (err, originalError) => {
if (originalError) {
errorReporting.report(err.originalError.stack);
} else {
errorReporting.report(err.stack);
}
}
})],
context: ({req}) => ({
request: req
})
});
FAQs
GraphQL server extension to track requests with errors
We found that graphql-error-tracking-extension demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.