Features

Websocket connection init payload forwarding

The gateway implements the graphql-transport-ws protocol. In that protocol, the first message on a websocket connection will be connection_init. That message contains an optional payload field that is a JSON object with arbitrary values. Typically, information that would go in HTTP headers for queries and mutations flows instead in that connection_init message's payload. Data like tokens that would otherwise go into the Authorization header are passed there instead.

Before this release, the ConnectionInit payload was not forwarded to the subgraph resolving the subscription. It is now forwarded by default. That behaviour can be disabled with the following configuration:

[websockets]
forward_connection_init_payload = false

Docs are available at https://grafbase.com/docs/reference/gateway/configuration/websockets

Implemented in #2508

Improvements

Trusted document incremental adoption

When trusted_documents.enabled = true and trusted_documents.enforced = false, the gateway fetches the trusted document whenever a trusted document id is present in the request. In 0.25.0 and 0.25.1, the gateway would return a hard error when no trusted document exists with that id, even when an inline document was in the query.

This is not in the spirit of audit mode: there is the document_id_unknown_log_level setting to log, potentailly with error level, to detect this problem, but it should not block the request. We now allow for a soft transition: when no trusted document is found, but an inline document is present, we will use the inline document to execute the query. This is useful for organizations who want to gradually adopt trusted documents.

Docs: https://grafbase.com/docs/reference/gateway/configuration/trusted-documents

Implemented in #2512