From 17653aa44144cb32197977b5a4581bcae073eb11 Mon Sep 17 00:00:00 2001
From: hwala <henry.wala@paessler.com>
Date: Fri, 17 Jul 2026 15:19:43 +0200
Subject: [PATCH 1/3] Authenticate sessionless tokens

---
 Classes/GraphQL/Middleware/GraphQLMiddleware.php       | 10 ++++++++++
 .../GraphQL/Middleware/GraphQLMiddlewareFactory.php    |  3 +++
 2 files changed, 13 insertions(+)

diff --git a/Classes/GraphQL/Middleware/GraphQLMiddleware.php b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
index e20596dc4..f9d33a818 100644
--- a/Classes/GraphQL/Middleware/GraphQLMiddleware.php
+++ b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
@@ -32,7 +32,9 @@
 use Neos\Flow\Log\ThrowableStorageInterface;
 use Neos\Flow\Mvc\ActionRequest;
 use Neos\Flow\Persistence\PersistenceManagerInterface;
+use Neos\Flow\Security\Authentication\AuthenticationManagerInterface;
 use Neos\Flow\Security\Context;
+use Neos\Flow\Security\Exception\AuthenticationRequiredException;
 use Psr\Container\ContainerInterface;
 use Psr\Http\Message\ResponseFactoryInterface;
 use Psr\Http\Message\ResponseInterface;
@@ -66,6 +68,7 @@ public function __construct(
         private readonly ContainerInterface $serviceLocator,
         private readonly CustomResolvers $customResolvers,
         private readonly PersistenceManagerInterface $persistenceManager,
+        private readonly AuthenticationManagerInterface $authenticationManager,
     ) {
     }
 
@@ -81,6 +84,13 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
             // Simulate a request to the specified controller to trigger authentication
             $mockActionRequest->setControllerObjectName($this->simulateControllerObjectName);
             $this->securityContext->setRequest($mockActionRequest);
+            try {
+                $this->authenticationManager->authenticate();
+            } catch (AuthenticationRequiredException) {
+                // Explicit call so sessionless tokens (e.g. OIDC/JWT) get authenticated.
+                // Unauthenticated requests are not rejected here but continue anonymously.
+                // The privilege targets decide whether they may access anything.
+            }
         }
         $response = $this->responseFactory->createResponse();
         $response = $this->addCorsHeaders($response);
diff --git a/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php b/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php
index 26ba68fff..a2099e691 100644
--- a/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php
+++ b/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php
@@ -22,6 +22,7 @@
 use Neos\Flow\Log\ThrowableStorageInterface;
 use Neos\Flow\ObjectManagement\ObjectManagerInterface;
 use Neos\Flow\Persistence\PersistenceManagerInterface;
+use Neos\Flow\Security\Authentication\AuthenticationManagerInterface;
 use Neos\Flow\Security\Context;
 use Psr\Http\Message\ResponseFactoryInterface;
 use Psr\Http\Message\StreamFactoryInterface;
@@ -40,6 +41,7 @@ public function __construct(
         private readonly ObjectManagerInterface $objectManager,
         private readonly CustomResolversFactory $customResolversFactory,
         private readonly PersistenceManagerInterface $persistenceManager,
+        private readonly AuthenticationManagerInterface $authenticationManager,
     ) {
     }
 
@@ -65,6 +67,7 @@ public function create(
             $this->objectManager,
             $this->customResolversFactory->create($customResolversSettings ?? []),
             $this->persistenceManager,
+            $this->authenticationManager,
         );
     }
 }

From 77755ffc6ece8bb4ba981007abe9475b76660651 Mon Sep 17 00:00:00 2001
From: Henry <46249106+MiauzGenau@users.noreply.github.com>
Date: Wed, 22 Jul 2026 11:42:21 +0200
Subject: [PATCH 2/3] Simplify authentication & and only authenticate if
 isAuthenticated status is set to null (unset)

---
 Classes/GraphQL/Middleware/GraphQLMiddleware.php | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/Classes/GraphQL/Middleware/GraphQLMiddleware.php b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
index f9d33a818..12dfd2c06 100644
--- a/Classes/GraphQL/Middleware/GraphQLMiddleware.php
+++ b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
@@ -81,16 +81,10 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         }
         if ($this->simulateControllerObjectName !== null) {
             $mockActionRequest = ActionRequest::fromHttpRequest($request);
-            // Simulate a request to the specified controller to trigger authentication
+            // Simulate a request to the specified controller
             $mockActionRequest->setControllerObjectName($this->simulateControllerObjectName);
             $this->securityContext->setRequest($mockActionRequest);
-            try {
-                $this->authenticationManager->authenticate();
-            } catch (AuthenticationRequiredException) {
-                // Explicit call so sessionless tokens (e.g. OIDC/JWT) get authenticated.
-                // Unauthenticated requests are not rejected here but continue anonymously.
-                // The privilege targets decide whether they may access anything.
-            }
+            $this->authenticationManager->isAuthenticated();  // Trigger authentication if isAuthenticated is null
         }
         $response = $this->responseFactory->createResponse();
         $response = $this->addCorsHeaders($response);

From ebe5d284c82f66cb946e6613afcba2dcda7eab97 Mon Sep 17 00:00:00 2001
From: Henry <46249106+MiauzGenau@users.noreply.github.com>
Date: Wed, 22 Jul 2026 12:59:17 +0200
Subject: [PATCH 3/3] Clean up unused Exception

---
 Classes/GraphQL/Middleware/GraphQLMiddleware.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Classes/GraphQL/Middleware/GraphQLMiddleware.php b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
index 12dfd2c06..ec5c94ec4 100644
--- a/Classes/GraphQL/Middleware/GraphQLMiddleware.php
+++ b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
@@ -34,7 +34,6 @@
 use Neos\Flow\Persistence\PersistenceManagerInterface;
 use Neos\Flow\Security\Authentication\AuthenticationManagerInterface;
 use Neos\Flow\Security\Context;
-use Neos\Flow\Security\Exception\AuthenticationRequiredException;
 use Psr\Container\ContainerInterface;
 use Psr\Http\Message\ResponseFactoryInterface;
 use Psr\Http\Message\ResponseInterface;