# Update package for dgraph-js-http **URL:** \ **Category:** Dgraph\ **Tags:** dgraph, dgraph-js-http, dgraph-js\ **Created:** [September 12, 2020, 3:33pm UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314 "2020-09-12T15:33:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![gotjoshua](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gotjoshua/32/4150_2.png) [@gotjoshua](https://discuss.dgraph.io/u/gotjoshua)\ **Post date:** [September 12, 2020, 3:33pm UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/1 "2020-09-12T15:33:57Z")
I am trying to setup @auth directives and it seems that master is updated at: > **[GitHub - dgraph-io/dgraph-js-http: A JavaScript HTTP client for Dgraph](https://github.com/dgraph-io/dgraph-js-http)** > > A JavaScript HTTP client for Dgraph. Contribute to dgraph-io/dgraph-js-http development by creating an account on GitHub. but even when i do: `yarn add https://github.com/dgraph-io/dgraph-js-http` I still get errors when trying to run the suggested command to register the auth token: [`dgraphClient.setAlphaAuthToken("My secret token value");`](https://github.com/dgraph-io/dgraph-js-http#configure-access-tokens) The version in my yarn.lock is 🙂 ```auto "dgraph-js-http@https://github.com/dgraph-io/dgraph-js-http": version "20.7.1-rc1" ``` which is not in the [list of tags nor releases](https://github.com/dgraph-io/dgraph-js-http/tags) Is master usable? Why does the version tag format keep changing? (eg: 20.07.0 → 20.7.1-rc1) ---
**Author:** ![chewxy](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/chewxy/32/4339_2.png) [@chewxy](https://discuss.dgraph.io/u/chewxy)\ **Post date:** [September 14, 2020, 3:06am UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/2 "2020-09-14T03:06:28Z")
I’ve just merged the latest dependencies (thanks to @catherineluse for the PR) Can you check if it works? ---
**Author:** ![gotjoshua](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gotjoshua/32/4150_2.png) [@gotjoshua](https://discuss.dgraph.io/u/gotjoshua)\ **Post date:** [September 14, 2020, 2:49pm UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/3 "2020-09-14T14:49:48Z")
i updated the package and i was able to call that function and successfully do an alter operation on an alpha that is [set up for securing alter operations](https://dgraph.io/docs/deploy/dgraph-administration/#securing-alter-operations) ! That much is great! Will you correct the tag and make an official release soon? However i was only able to succeed from node.js as the browser fails due to cors errors, reported here: > [@@auth, cors, securing alter operations, and request headers](http://discuss.hypermode.com/t/auth-cors-securing-alter-operations-and-request-headers/10345): > > Expected behaviour and actual result. I expect the server to return all allow-headers needed for the various types of auth and auth tokens that are supported. The current list does not include X-Dgraph-AuthToken [which is referenced here in the securing alter operations section.](https://dgraph.io/docs/deploy/dgraph-administration/#securing-alter-operations) this is what Chrome shows in the network pane: access-control-allow-headers: X-Dgraph-AccessToken, Content-Type, Content-Length, Accept-Encoding, Cache-Control, X-CSRF-Token, X-Auth-Token, X-Requested-With This mean… ---
**Author:** ![chewxy](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/chewxy/32/4339_2.png) [@chewxy](https://discuss.dgraph.io/u/chewxy)\ **Post date:** [September 14, 2020, 9:39pm UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/4 "2020-09-14T21:39:49Z")
@Paras wondering if this is something you could look at? (re: release and auth) ---
**Author:** ![Paras](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/paras/32/2768_2.png) [@Paras](https://discuss.dgraph.io/u/Paras)\ **Post date:** [September 14, 2020, 9:48pm UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/5 "2020-09-14T21:48:33Z")
@paulftw owns this client. tagged him. ---
**Author:** ![gotjoshua](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gotjoshua/32/4150_2.png) [@gotjoshua](https://discuss.dgraph.io/u/gotjoshua)\ **Post date:** [September 15, 2020, 7:28am UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/6 "2020-09-15T07:28:25Z")
Guys, I think the auth part is fine from the client side (except maybe documentation), the main repo needs to add the allowed header… Perhaps you could use an additional function for setting for X-CSRF-Token in the client (as this is already allowed by the backend) - but all this can also be done without specialized functions just by setting the headers when creating the clientStub: ```auto const headers = { ['X-CSRF-Token']:X_USER_AUTH_TOKEN, // ['X-Dgraph-AuthToken']:X_DGRAPH_AUTH_TOKEN, // this is not permitted by alpha cors - and does exactly the same as setAlphaAuthToken() ['X-Auth-Token']:X_USER_AUTH_TOKEN // this is allowed but doesn't do anything related to alter restriction - but can be used with GraphQL @auth rules } const newStub = await new DgraphClientStub(DGRAPH_URL,undefined,{headers}) ``` ---
**Author:** ![paulftw](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/paulftw/32/1569_2.png) [@paulftw](https://discuss.dgraph.io/u/paulftw)\ **Post date:** [September 21, 2020, 10:07am UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/7 "2020-09-21T10:07:48Z")
@gotjoshua I’ve published the latest version to npm, you should be able to `yarn add dgraph-js-http` and get a working version of the library. Let me know if you see any other issues ---
**Author:** ![gotjoshua](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gotjoshua/32/4150_2.png) [@gotjoshua](https://discuss.dgraph.io/u/gotjoshua)\ **Post date:** [September 27, 2020, 7:49pm UTC](https://discuss.dgraph.io/t/update-package-for-dgraph-js-http/10314/8 "2020-09-27T19:49:41Z")
thanks @paulftw! Looks good so far…