Propagating Downstream Response Headers (set-cookie) to the Wundergraph Reponse

Problem

Hi Wundergraph! Our downstream client uses cookie based authentication where, on a successful login mutation, they pass a set-cookie header in the response with the auth token. With this flow, we would need to pass this header upto the client but I’m not seeing anywhere to do this. With request headers it’s simple as we can specify to pass them in the introspect.graphql options but there’s no option for response headers. My other thought was to hook into the originResponse however I’m not sure how I can use this hook to mutate the final response. Can this be done?

Suggested solution

Similar to passing request headers in the graphql introspection, can we also add response headers in the same section? There’s complications to this due to a Wundergraph query potentially making multiple requests to the downstream api. We could add an enum with values of collate and overwrite so that the former would add all the values of the header in question to a comma-delimited string whilst the latter just chooses the last value set. Not too much thought has gone into the above though so there might be stumbling blocks.

Additional context

My downstream response headers:

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: Opaque_token=aaa-bbbccc000ddd111eee222fff333-; Path=/; Domain=www.testdomain.com; Expires=Tue, 30-May-2023 13:14:20 GMT; Max-Age=15552000; Secure; HttpOnly
Strict-Transport-Security: max-age=31536000
Vary: Origin
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

The response headers on the Wundergraph response:

HTTP/1.1 200 OK
Content-Type: application/json
Vary: Origin
Date: Thu, 01 Dec 2022 13:14:20 GMT
Content-Length: 119

[jensneuse]

Let me know your thoughts on this one: https://github.com/wundergraph/wundergraph/discussions/389

[OLingard]

We’re not using Wundergraph authentication right now. You’re correct with the later point, authentication would solely be handled by the origin service. Wundergraph would just needs to pass on the set-cookie response header and the cookie request header (the latter is easily done).