JWT Authentication graphql-spqr with spring security

Question

I am using graphql-spqr-spring-boot-starter, version 0.0.5 in my spring boot application.

@GraphQLApi & @GraphQLQuery working fine and I am fetching data on /gui as well.

But as many have faced I am trying to apply the authentication part on graphql server calls. I am using JWT token in my application for REST API authorization/authentication.

So I have token which I suppose can be used for validation here as well.

I have tried using:

@PreAuthorize("hasRole('ROLE_RECRUITER_HR')")

but it gives compile time error:

io.leangen.graphql.metadata.exceptions.TypeMappingException: The registered object of type com.sun.proxy.$Proxy90 appears to be a dynamically generated proxy

For these and other possible issues, is it better to use wrapper graphql library like spring-boot-starter or it is safer to use graphql-spqr which more steps in my hand.

Answer 1

EDIT: GraphQL SPQR Spring Boot starter v0.0.6 fixed the issue and should work out of the box.

This is a bug in the starter. It doesn't properly detect the types when JDK proxies (and not CGLib) are used. I will make sure to fix this for the next release. There's a couple of ways to temporarily work around this, but none of them are nice unfortunately.

You could e.g. force Spring to use CGLIB by e.g.

@EnableAspectJAutoProxy(proxyTargetClass = true)

but this has potentially wide implications so I would recommend you simply wait a bit. I'll release a new version with a fix in a couple of days, as this is a very important bug.