All requests are always authenticated

I’m not sure if I am missing out something, I have checked thoroughly that I have added the MIDDLEWARE and AUTHENTICATION_BACKENDS correctly. I am using the @login_required decorator to protect a query that responds with user information if successful.

However, when I use the GraphQL interactive window to send an unauthenticated query, it responds back with a users info(superuser created using the model managers createsuperuser function). The interactive window has no provision to include the Authorization header, therefore this query should not resolve in the first place.

Below are some of my code snippets:

class UserType(DjangoObjectType):
    class Meta:
        model = get_user_model()

class Query(graphene.ObjectType):
    me = graphene.Field(UserType)

    @login_required
    def resolve_me(self, info, **kwargs):
        return info.context.user

[GalaxyZpj]

Make sure you are logged out of admin.

[nrgx]

I’ve just setup backend, and didn’t prepared frontend. But yes, I will use localStorage.

On Mon, Mar 23, 2020, 8:20 AM assman [e-mail] wrote:

@nrgx https://github.com/nrgx thank you for sharing 😃

This is kind of unrelated to the issue, can I check with you, where do you store the token on the client side? i.e localStorage or cookies?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/flavors/django-graphql-jwt/issues/180#issuecomment-602326961, or unsubscribe https://github.com/notifications/unsubscribe-auth/AEKNYTFDCVS4MUV4AW3TDHTRI3BP5ANCNFSM4LGKNYSQ .