documentation of how to handle Authorization

Story

I’m want to be able to send user authorization token that can modify the GraphQL context

---

When using subscriptions-transport-ws I could generate the GraphQL Context using the onConnect helper

https://github.com/sibelius/relay-workshop/blob/master/packages/server/src/index.ts#L30

import { SubscriptionServer } from 'subscriptions-transport-ws';

SubscriptionServer.create(
    {
      onConnect: async (connectionParams: ConnectionParams) => {
        const { user } = await getUser(connectionParams?.authorization);

        return getContext({ user });
      },
      // eslint-disable-next-line
      onDisconnect: () => console.log('Client subscription disconnected!'),
      execute,
      subscribe,
      schema,
    },
    {
      server,
      path: '/subscriptions',
    },
  );

When using this package, we need to pass context on server creating that we won’t be able to modify context based on use authorization token

[sibelius]

should this be another recipe?

[enisdenjo]

I personally like performing authorization on every subscription request (in onSubscribe). In cases where you’re using token based auth, running a check on every operation request guarantees expiry detection or manipulation prevention.