[GraphiQL] Change updateURL Behaviour

[blakeembrey]

I started using GraphiQL with an API and needed authentication to work, so I worked around this by having the API to respond to a specific referrer auth errors by sending the implicit OAuth 2.0 URL that people can see in the panel. Unfortunately, when someone types it wipes out the existing state in the URL. Is it possible to retain window.location.hash instead of wiping it out so subsequent attempts can use the token? Either that, or disabling the history.replaceState, would likely work. Happy to submit a PR.

Side note: Authentication with this approach is a little backward, but I think it turned out really nicely for demonstrating an API-first application by prompting ways to get a token without much interruption.

[stubailo]

I think this might be better filed here! https://github.com/graphql/graphiql

[blakeembrey]

Why's that? I thought this was the relevant snippet: https://github.com/apollographql/graphql-server/blob/79458e2ebb687a8dc76ee986ca1e5dd6dd3397eb/packages/graphql-server-module-graphiql/src/renderGraphiQL.ts#L158.

[stubailo]

You know what, you're totally right!

I think if you send a PR with an option to disable that, we'll happily accept it!