Returning an early error message if the token is invalid

server/.env.example

@@ -2,3 +2,7 @@ GRAPHQL_API_URL=https://app-api.advancedalgos.net/graphql
 TEAMS_API_URL=https://teams-api.advancedalgos.net/graphql
 USERS_API_URL=https://users-api.advancedalgos.net/graphql
 KEYVAULT_API_URL=https://keyvault-api.advancedalgos.net/graphql
+
+AUTH0_DOMAIN=auth0-domain
+AUTH0_AUDIENCE=auth0-audience
+AUTH0_ISSUER=auth0-issuer

server/package.json

@@ -31,8 +31,10 @@
     "cors": "^2.8.4",
     "dotenv": "^6.1.0",
     "express": "^4.16.3",
+    "express-jwt": "^5.3.1",
     "graphql": "^14.0.2",
     "graphql-tools": "^4.0.0",
+    "jwks-rsa": "^1.3.0",
     "node-fetch": "^2.2.0",
     "winston": "^3.1.0"
   }

server/src/index.js

@@ -3,6 +3,9 @@ import cors from 'cors'
 import 'dotenv/config'
 import { ApolloServer } from 'apollo-server-express'
 import { mergeSchemas } from 'graphql-tools'
+import jwt from 'express-jwt'
+import jwksRsa from 'jwks-rsa'
+
 import { createTransformedRemoteSchema } from './createRemoteSchema'
 import { teams } from './links'
 import logger from './logger'
@@ -67,6 +70,31 @@ async function run () {
     }
   })
 
+  app.use('/graphql',
+    jwt({
+      secret: jwksRsa.expressJwtSecret({
+        cache: true,
+        rateLimit: true,
+        jwksRequestsPerMinute: 1,
+        jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`
+      }),
+      credentialsRequired: false,
+      audience: process.env.AUTH0_AUDIENCE,
+      issuer: process.env.AUTH0_ISSUER,
+      algorithms: [`RS256`]
+    }),
+    function (err, req, res, next) {
+      if (err.code === 'invalid_token') {
+        res.send({
+          'type': 'invalidToken',
+          'subType': err.message
+        })
+        return 0
+      }
+      return next()
+    }
+  )
+
   server.applyMiddleware({ app })
 
   app.use(cors())