Is it safe to specify errors plugin before scope auth plugin?

[knpwrs]

The following notice appears on the Auth Plugin page:

IMPORTANT

When using scope-auth with other plugins, make sure that the scope-auth plugin is listed first to ensure that other plugins that wrap resolvers do not execute first.

However, if I want to use the Errors Plugin to provide error types within the schema for authorization errors (ForbiddenError as defined by the auth plugin) then the Errors plugin, which wraps fields, must be specified before the auth plugin.

I believe this should be safe, but I wanted to check first. Is specifying the errors plugin before the auth plugin considered safe? Should the documentation be updated to reflect this if so?

[hayes]

Yes, provided the content of your errors are not sensitive. Basically the error types in the response mah not be protected by authorization checks, but I think for all cases I can think of this is okay. You should still be able to add authorization checks to specific fields of the error types if they need to be protected as well.