Block unauthorized requests when 'anon' role is not defined

config/allow.list

@@ -159,7 +159,6 @@ query {
   }
 }
 
-
 variables {
 	"data": {
 		"email": "gfk@myspace.com",
@@ -272,4 +271,20 @@ query {
   }
 }
 
+query {
+  users {
+    id
+    email
+    picture: avatar
+    password
+    full_name
+    products(limit: 2, where: {price: {gt: 10}}) {
+      id
+      name
+      description
+      price
+    }
+  }
+}
+
 

config/dev.yml

@@ -12,8 +12,7 @@ log_level: "debug"
 use_allow_list: false
 
 # Throw a 401 on auth failure for queries that need auth
-# valid values: always, per_query, never
-auth_fail_block: never
+auth_fail_block: false
 
 # Latency tracing for database queries and remote joins
 # the resulting latency information is returned with the

config/prod.yml

@@ -16,8 +16,7 @@ log_level: "info"
 use_allow_list: true
 
 # Throw a 401 on auth failure for queries that need auth
-# valid values: always, per_query, never
-auth_fail_block: always
+auth_fail_block: true
 
 # Latency tracing for database queries and remote joins
 # the resulting latency information is returned with the