{"action":"created","issue":{"url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql/issues/358","repository_url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql","labels_url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql/issues/358/labels{/name}","comments_url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql/issues/358/comments","events_url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql/issues/358/events","html_url":"https://github.com/Folkloreatelier/laravel-graphql/issues/358","id":340248597,"node_id":"MDU6SXNzdWUzNDAyNDg1OTc=","number":358,"title":"Authenticated method does not return the right status code","user":{"login":"hshahdoost","id":1842220,"node_id":"MDQ6VXNlcjE4NDIyMjA=","avatar_url":"https://avatars0.githubusercontent.com/u/1842220?v=4","gravatar_id":"","url":"https://api.github.com/users/hshahdoost","html_url":"https://github.com/hshahdoost","followers_url":"https://api.github.com/users/hshahdoost/followers","following_url":"https://api.github.com/users/hshahdoost/following{/other_user}","gists_url":"https://api.github.com/users/hshahdoost/gists{/gist_id}","starred_url":"https://api.github.com/users/hshahdoost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hshahdoost/subscriptions","organizations_url":"https://api.github.com/users/hshahdoost/orgs","repos_url":"https://api.github.com/users/hshahdoost/repos","events_url":"https://api.github.com/users/hshahdoost/events{/privacy}","received_events_url":"https://api.github.com/users/hshahdoost/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-11T13:44:23Z","updated_at":"2018-07-12T07:30:37Z","closed_at":null,"author_association":"NONE","body":"Please correct me if I'm wrong but I believe the `authentcated` method in `Field` class, (which we can override in every query or mutation to ensure authentication) is not returning the right status code. Since `authorized` method returns stats code of 403 (forbidden) in case of failure. `authentcated` method shall return 401 (unauthenticated). \r\nKeep in mind that this status code is very important for the client authentication process, since libraries such as `OkHttpClient` consider the 401 authentication failure and would automatically call the authenticator callback when it's being returned."},"comment":{"url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql/issues/comments/404417025","html_url":"https://github.com/Folkloreatelier/laravel-graphql/issues/358#issuecomment-404417025","issue_url":"https://api.github.com/repos/Folkloreatelier/laravel-graphql/issues/358","id":404417025,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNDQxNzAyNQ==","user":{"login":"hshahdoost","id":1842220,"node_id":"MDQ6VXNlcjE4NDIyMjA=","avatar_url":"https://avatars0.githubusercontent.com/u/1842220?v=4","gravatar_id":"","url":"https://api.github.com/users/hshahdoost","html_url":"https://github.com/hshahdoost","followers_url":"https://api.github.com/users/hshahdoost/followers","following_url":"https://api.github.com/users/hshahdoost/following{/other_user}","gists_url":"https://api.github.com/users/hshahdoost/gists{/gist_id}","starred_url":"https://api.github.com/users/hshahdoost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hshahdoost/subscriptions","organizations_url":"https://api.github.com/users/hshahdoost/orgs","repos_url":"https://api.github.com/users/hshahdoost/repos","events_url":"https://api.github.com/users/hshahdoost/events{/privacy}","received_events_url":"https://api.github.com/users/hshahdoost/received_events","type":"User","site_admin":false},"created_at":"2018-07-12T07:30:37Z","updated_at":"2018-07-12T07:30:37Z","author_association":"NONE","body":"@mfn Yes, I'm sorry, I actually wrote the word incorrectly, it was **Unauthorized**.\r\nbut, as you better know the difference between forbidden (403) and unauthorized (401) is that when 401 is returned it is expected to be solved by authentication (at the first level) and then authorization. But receiving 403 means that there is no way we can access to this data, so the request should not be repeated. (as being explained [here](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2))\r\nNow all I'm saying is that It would be more appropriate to receive 401 since the client side considers it as a valid status code for authentication.\r\nIn the meantime, thanks a lot for such a quick response.\r\n\r\n**PS**: I also saw that part of the code, and wondered wouldn't it be better if the status code of the page would be set in the `Error` class? I know that graphql is on top of http and should not involve with it's technicality, but I think somehow it would be nicer to be able to extend the `Error` class and implement different types of errors with different status codes.  \r\n"}}
{"actor":{"display_login":"hshahdoost"}}