[Django][Auth] About GraphQLView and (not) AnonymousUser

[lorddaedra]

I followed tutorial on page https://ariadnegraphql.org/docs/django-integration and integrated ariadne with Django.

Typical scenario for most of APIs - get some user related data. I logged in to Django based project as admin (using default Django admin panel /admin/) and I also replaced example resolver code line to
return "Hello {}!".format(info.context["request"].user)
I expected to see admin user in result because of I logged in as admin.

I opened http://127.0.0.1:8000/graphql/ and executed this request:

{ hello }

And got this result:

{
  "data": {
    "hello": "Hello AnonymousUser!"
  }
}

How to fix it?..

[lorddaedra]

Just to mention, I tried to make request from browser console, this works as expected:

fetch('http://127.0.0.1:8000/graphql/', {
  method: 'POST',
  body: JSON.stringify({
    query: `query {
      hello
    }`
  }),
  headers: {
      'content-type': 'application/json'
  }
}).then(async (data) => {
    console.log(await data.json());
});

So problem related with GraphQLView and related things...

[rafalp]

You are not authenticated with the API because your JS code is not sending any authentication credentials. Assuming you are using default Django auth, it requires session cookies to work, and fetch needs to be told to include those.

[lorddaedra]

@rafalp Thank you for answer!

But how to fix it, it's not clear for me?..

My custom request (from second message) works without any problems at all, I used browser console to execute it and got my user name as excepted.

But this web GUI, https://127.0.0.1:8000/graphql/ (Playground) not works as expected. I opened browser dev tools, Network page and discovered that It uses http://cdn.jsdelivr.net/npm/graphql-playground-react/node_modules/apollo-link-http/lib/bundle.esm.js to create fetch requests.

So looks like it's integration bug between Playground and ariadne. Ariadne need change some Playground config (include fetch options) to make Playground works correctly...

[lorddaedra]

@rafalp May be we need add some options here to fix that bug?

ariadne/ariadne/contrib/django/views.py

Line 31 in 04ed6d1

DEFAULT_PLAYGROUND_OPTIONS = {"request.credentials": "same-origin"}

[lorddaedra]

I just realized that these options (from SO link) already exist in DEFAULT_PLAYGROUND_OPTIONS ... Why doesn't Playground work then? ..

[rafalp]

There are two things here:

There's indeed a bug with DEFAULT_PLAYGROUND_OPTIONS. Correct value would be:

DEFAULT_PLAYGROUND_OPTIONS = {"settings": {"request.credentials": "same-origin"}}

This bug can be worked around by defining this setting in your GraphQLView:

    path(
        'graphql/',
        GraphQLView.as_view(
            schema=schema,
            playground_options={
                "settings": {
                    "request.credentials": "include"
                }
            }
        ),
        name='graphql',
    ),

---

We've deprecated ariadne.contrib.django with plan to remove this code from Ariadne's codebase soonish, which makes fixing this in Ariadne counter-productive for me (especially when this has easy workaround).

Could you please raise this issue with ariadne-django maintainers?

Thanks!