Server sends 200 response when secret key changes, not 401

When the server secret key changes all tokens are invalidated because they can no longer be decrypted. However, instead of returning a response with code 401-Unauthorized, the server returns a response with code 200-OK and includes the deserialization error in the response.

Example response:

{  
   "errors":[  
      {  
         "message":"Error decoding signature",
         "locations":[  
            {  
               "line":1,
               "column":38
            }
         ],
         "path":[  
            "createTeam"
         ]
      }
   ],
   "data":{  
      "createTeam":null
   }
}

If time allows, I’ll follow this up with a PR to correct the issue.

[jckw]

I think @jayhale is suggesting that the response status code is changed to HTTP 401 instead. That way, generic middleware can recognise when a request was unsuccessful due to a token being invalid and can automatically refresh it.

[jayhale]

@themotu, we avoided this library and instead wrote the authenticator in-house.