Summary
GraphQL endpoints return HTML 404 page when a Cookie header is present in the request, regardless of cookie value.
Reproduction
# Without Cookie header - works
curl -s -X POST "http://api-<tenant>.localhost:3000/graphql" \
-H "Content-Type: application/json" \
-d '{"query":"{ __typename }"}'
# Returns: {"data":{"__typename":"Query"}}
# With Cookie header - returns 404
curl -s -X POST "http://api-<tenant>.localhost:3000/graphql" \
-H "Content-Type: application/json" \
-H "Cookie: constructive_session=<valid-token>" \
-d '{"query":"{ __typename }"}'
# Returns: <html>...<title>Not Found</title>...</html>Expected Behavior
- Cookie header should be parsed for session token
- Request should authenticate and return GraphQL response
- If token invalid, should return JSON error, not 404 HTML
Actual Behavior
- Any Cookie header causes 404 HTML response
- Happens on both
auth-* and api-* endpoints
- Bearer token auth works fine
Environment
- GraphQL server on port 3000
- Scoped routing enabled (
API_ENABLE_SCOPED_ROUTING=true)
- Tenant: cookie_sess_e2e
Investigation Notes
This blocks cookie-based session research. May be related to:
- Cookie parsing in routing middleware
- CSRF protection middleware rejecting requests
- Host/subdomain routing logic
Related
Testing cookie-based sessions for mobile SDK research.
Summary
GraphQL endpoints return HTML 404 page when a
Cookieheader is present in the request, regardless of cookie value.Reproduction
Expected Behavior
Actual Behavior
auth-*andapi-*endpointsEnvironment
API_ENABLE_SCOPED_ROUTING=true)Investigation Notes
This blocks cookie-based session research. May be related to:
Related
Testing cookie-based sessions for mobile SDK research.