Apollo Server 5.5

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. When Apollo Server runs in Express through expressMiddleware, also apply the Express prompt for its installed version. These rules cover Apollo Server 5.5 context, credential lifetime, resolvers, authorization, schema exposure, query cost, CSRF prevention, CORS, errors, plugins, and deployment.

Context and authentication

• Authenticate each HTTP request and subscription operation before constructing privileged context values.
• Apollo Server has no session or login API, and it calls context once per HTTP request. Check the session or token there against server-side state, not just its signature and expiry, so a logout or revocation takes effect on the next operation.
• Derive principal, tenant, roles, and data loaders from verified credentials rather than request arguments or headers alone.
• Create request-scoped context and data loaders so cached objects cannot cross users or tenants.
• Keep credentials, database clients, and internal service objects out of resolver return values and error extensions.
• Subscriptions outlive the checks that admitted them: graphql-ws runs onConnect once per socket and useServer's context once per subscription, never per event, and an open socket can't take new connectionParams. Close the socket with ctx.extra.socket.close(4403, 'Forbidden') when its token expires, its session is revoked, or the user logs out, so the client reconnects with fresh credentials, and recheck access per event in a withFilter filter, which receives contextValue as its