Prior to this commit, secured applications with CSRF protection could
not easily use the GraphiQL integration shipped with Spring for GraphQL,
as the JavaScript code would not work with any CSRF protection strategy
for single page apps.
This commit checks whether the main HTTP response contains a
`XSRF-TOKEN` Cookie value, and uses it as a `X-XSRF-TOKEN` request
header for the next AJAX request to the `/graphql` endpoint.
Note that a specific configuration must be set in Spring Security to
achieve that:
* the CSRF token must be sent as a response Cookie for the initial
authenticated request
* if the application is protected against BREACH, all new token values
must be sent as response cookies as well and a request handler must be
configured
Closes gh-758
Prior to this commit, the Observability instrumentation would instrument
`DataFetcher` instances and set the current observation in the local
context of the value returned by the data fetcher itself.
This allowed to properly build a parent/child chain of observations
between the main request and the instrumented data fetching
observations.
Because the current observation was not set in the
`DataFetchingEnvironment` given as a parameter to the data fetcher, any
operation done in the data fetcher would not propagate using the current
observation but instead the parent one.
This commit revisits the implementation of the instrumentation to not
wrap the result anymore, but to build a new local `GraphQLContext` that
holds the current observation right before calling the data fetcher.
Note that we cannot "just" set the current observation in that local
context as this is shared mutable instance for all child data fetchers.
Fixes gh-757
This commit also ensures that a new local context is created, copying
the existing values. This avoids mutating the parent local context and
polluting it with local values.
This could cause unintended side effects on other child datafetchers.
Fixes gh-761
Prior to this commit, a `DataFetcher` instrumented by the
`GraphQlObservationInstrumentation` would incorrectly overwrite the
local context when:
* the `DataFetcher` returns a value object (i.e. not a
`DataFetcherResult`)
* the given `DatFetchingEnvironment` has an existing local context
with values
For this case, the instrumentation would create a new local context but
would not inherit from the existing local context.
See gh-761
