Protect GraphQL view (for example schema definition) to require login

Problem description:

django_graphql_jwt provides nice decorators to protect queries and mutations. However there is no easy way to protect GraphQL view to non-authenticated users. When using basic django authentication this problem could be solved using mixin classes or decorators:

# Using decorators
from django.contrib.auth.decorators import login_required
path('graphql/', login_required(GraphQLView.as_view(graphiql=True)))

# Using mixin classes
from django.contrib.auth.mixins import LoginRequiredMixin
from graphene_django.views import GraphQLView

class PrivateGraphQLView(LoginRequiredMixin, GraphQLView):
    """Adds a login requirement to graphQL API access via main endpoint."""
    pass

However these solutions are not working when using JWT tokens.

This problem leads to a situation where anonymous users can view my whole schema definition and maybe search vulnerabilities. Current situation:

urlpatterns = [
    path('admin/', admin.site.urls),
    path('graphql/', csrf_exempt(GraphQLView.as_view(graphiql=True))),

Possible solutions:

Provide decorators or mixin classes that can be used as in standard django.contrib.auth module

[pipedex]

Hi , @LinnaViljami . You can divide your schemas in public and private endpoints. So, you can have one endpoint to login schema for public without login_required and one endpoint schema for private querys and mutations.

url('ingreso-login', csrf_exempt(FileUploadGraphQLView.as_view(graphiql=True, schema=schema1.schema1))),
url('ingreso-general', login_required(csrf_exempt((FileUploadGraphQLView.as_view(graphiql=True)))))

It is working for my on django 1.11 project.

But now i am upgrading to django 3.2 and sorpresively , when i protect with login_required my private schema, i get the token from login schema but dont can continue with the private endpoint schema.

[lanshunfang]

@LinnaViljami ^^