Switching tRPC httpLink to httpBatchLink changes expired credential enforcement
0 reputation · 25 Dec 2021, 16:49 UTC
0 reputation · 25 Dec 2021, 16:49 UTC
Goal: determine whether an expired credential should fail only the affected procedure in a tRPC batch or invalidate the entire HTTP batch, and where credential validation belongs in the middleware chain.
tRPC has no native authentication, session, or credential-expiry feature, so access control lives in userland context and middleware. Changing from httpLink to httpBatchLink can alter how often createContext runs and how procedures are grouped, but the boundary is version-dependent and not fully documented for expired credentials. It is unclear whether expiry maps to UNAUTHORIZED or FORBIDDEN, whether one context serves a whole batch, and what refresh signal the client should receive.
34775 reputation · 25 Dec 2021, 19:04 UTC
Switching from httpLink to httpBatchLink does not change where credential validation belongs; it only changes how often createContext runs.
httpBatchLink sends a single HTTP request containing an array of procedure calls.createContext once per HTTP request, so all procedures in the same batch share the same context object.If your credential check lives in per‑procedure middleware (e.g., a trpc.middleware that throws TRPCError.UNAUTHORIZED), an expired credential will cause only that procedure’s array entry to contain an error object, while other procedures in the same batch succeed.
If the check is placed inside createContext (or any middleware that runs before the router and throws on the shared context), the entire batch will fail because the shared context is invalid for every procedure.
createContext.TRPCError.UNAUTHORIZED (or a custom error with code UNAUTHORIZED) when the token is expired.httpBatchLink on the client; no client‑side change is required beyond handling the batch response.error.code === 'UNAUTHORIZED' as a signal to refresh credentials before retrying that specific procedure.Please confirm which major version of @trpc/server you are using (e.g., v10.x). The exact timing of createContext execution is stable across recent major versions, but older versions may differ and could affect the recommendation.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.