GraphQL Spring AccessDeniedException Handling - spring

Question

I am using annotation "#PreAuthorize" for my resolver class and as a consequence I get AccessDeniedException. That's what i want but it is thrown to my log console on server.
I tried lots of things to get off this error and handle it some way just to maybe print one line for example "unauthorized attempt" but not whole stack trace. Do you have any idea where should I handle it?
2020-05-16 12:21:27.026 WARN 12308 --- [0.1-1100-exec-1] g.e.SimpleDataFetcherExceptionHandler : Exception while fetching data (/somePath) : Access is denied
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688) ~[spring-aop-5.1.6.RELEASE.jar:5.1.6.RELEASE]```

Answer 1

You can provide your own extension of the AsyncExecutionStrategy and then construct it with your own DataFetchingExceptionHandler like this:
#Component
public class QueryExecutionStrategy extends AsyncExecutionStrategy {
public QueryExecutionStrategy() {
super(new GraphQLExceptionHandler());
}
#Override
public CompletableFuture<ExecutionResult> execute(ExecutionContext executionContext,
ExecutionStrategyParameters parameters)
throws NonNullableFieldWasNullException {
return super.execute(executionContext, parameters);
}
}
While the ExceptionHandler could look something like this:
public class GraphQLExceptionHandler implements DataFetcherExceptionHandler {
private final Logger log = LoggerFactory.getLogger(GraphQLExceptionHandler.class);
#Override
public DataFetcherExceptionHandlerResult onException(DataFetcherExceptionHandlerParameters handlerParameters) {
Throwable exception = handlerParameters.getException();
SourceLocation sourceLocation = handlerParameters.getSourceLocation();
ExecutionPath path = handlerParameters.getPath();
if (exception instanceof AccessDeniedException) {
log.warn("unauthorized to access " +
path);
}
ExceptionWhileDataFetching error = new ExceptionWhileDataFetching(path, exception, sourceLocation);
log.warn(error.getMessage(), exception);
return DataFetcherExceptionHandlerResult.newResult().error(error).build();
}
}
You can also then just completely disable any errors reported to the client by returning a DataFetcherExceptionHandlerResult without any errors attached inside the if statement.