Hey all! Say I have a `graphql` route in my ktor a...

# ktor

[Arnab]

Hey all! Say I have a graphql route in my ktor app. I want that route to be authenticated, but I don't want there to be any authentication on Introspection queries. Is that possible?

[Aleksei Tirman [JB]]

Do you mean to disable authentication if some specific query parameters are present?

[Arnab]

No as in the introspection query for a graphql server should return all the types without requiring any authentication, but the actual real queries should be authenticated.

[Aleksei Tirman [JB]]

Could you please explain it in terms of HTTP?

[Arnab]

Well, the introspection query is a special query that all graphql servers respond to with all the capabilities that the server implements. Think of it as an endpoint that returns a sort of response that creates your API documentation clientside. This should be open to all without any authentication. Regular queries should be different, and behind authentication.

[Arnab]

See: https://graphql.org/learn/introspection/

[Nikky]

i think the best you can do is.. check for auth headers after you know if it is a introspection query or not.. but thats not something ktor builtin functionality can do

[Arnab]

Yeah, that's what I gathered. Just use authenticate(optional = true) { ... }