feat(api-graphql): pass authToken via subprotocol

[iartemiev]

Description of changes

AppSync Realtime is changing the way it accepts auth tokens when establishing subscription connections.

Today auth tokens are passed in the connection url as a query string param, e.g. wss://api.example.com/graphql?header=<base64_encoded_token>

Going forward, the service expects the client to pass the auth token through as a WS subprotocol:

const url = 'wss://api.example.com/graphql'
const protocols = ['graphql-ws', 'base64url_encoded_token']

new WebSocket(url, protocols)

This change is an implementation detail that does not affect the behavior of the AppSyncRealtime client. AppSync will continue to accept the auth token in query params for existing APIs, so older versions of the Amplify library will work as expected.

Note

The WebSocket Web API prohibits separator characters in subprotocol values, e.g. /, =, which are part of the standard base64 char set. With this change, the auth token is encoded as base64url, which lacks any prohibited characters in its alphabet. AppSync now supports this encoding for auth headers.

The change is also being back-ported to v5 here: #13726

Description of how you validated changes

• manual testing
• updated unit tests
• E2Es: https://github.com/aws-amplify/amplify-js/actions/runs/10579328718?pr=13727

Checklist

• PR description included
• yarn test passes
• Unit Tests are changed or added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[david-mcafee]

LGTM, just left one non-blocking comment!

[ashika112]

Approving on bundle size increase

[HuiSF]

nit: options should've been typed by the Base64Encoder

[iartemiev]

It is, I just wanted it to be more explicit, but I can follow up and remove in another PR if you prefer

[HuiSF]

oops, should the urlSafe be an optional property too, otherwise when you specify skipPadding you'd need to pass in a value for urlSafe as well. This is a internal tooling, I think it's safe to make a necessary change.

[iartemiev]

This was intentional. skipPadding would only be valid if urlSafe is set to true.