Getting `AUTH_NOT_AUTHORIZED ` in version 13.0.0 and later

Is there an existing issue for this?

• I have searched the existing issues

Product

Hot Chocolate

Describe the bug

Starting with version 13.0.0-rc8/13.0.0 all type fields with a [Authorize(Policy = "SomePolicy")] annotation are now always returning an AUTH_NOT_AUTHORIZED error:

{
  "errors": [
    {
      "message": "The current user is not authorized to access this resource.",
      "extensions": {
        "code": "AUTH_NOT_AUTHORIZED"
      }
    }
  ]
}

Until version 13.0.0.-rc7 and without code changes everything works as expected.

Our implementation is very closed on what is described on the HC documentation.

I’ve checked both the release notes and migration guide on the website, but couldn’t find an clue.

I would be very thankful for any hint. At the moment we have to stick at version 13.0.0-rc7.

Steps to reproduce

I’ve prepared two demo projects for both version 13.0.0-rc7 and 13.0.1 with instructions about how to reproduce the issue. https://github.com/marcel-rudolph/hc13-issue-demo

Relevant log output

There are no further exceptions or log messages beside the above posted response example.

Additional Context?

No response

Version

13.0.1

[michaelstaib]

yes and no 😃

YouTube episode is coming tomorrow.

youtube.chillicream.com

[PascalSenn]

@WalissonPires I believe this is because the policy now by default runs on validation. So there will not be a resolver context and this is also why you get a HttpContext.

If you want to run it not on validation but BEFORE_RESOLVER then you have to specify it:

[Authorize(Policy = "SomePolicy", Apply=ApplyPolicy.BEFORE_RESOLVER)]

@psiservices-dbrink i agree this should go in the docs