Missing verifier on attachment url : Submissions graphQL query

[tailorEd]

I created a graphQL query for submissions which provides data for all courses and students submissions including attachments url. When I designed the query and tested it in the garphiQL tool I was able to get attachment urls that included the verifier. However, when sending the query independently I get the url without the verifier. How can I fix this? What am I missing? Not sure if this helps but, I send the query with a token I created on the app. I was able to retrieve Assignments, Submissions, Student rosters etc with this token so far.

Here is the query: 

query MyQuery {

  course(id: 'course_id') {

    courseCode

    createdAt

    name

    sisId

    state

    submissionsConnection(filter: {submittedSince: "',last_submission,'"}, last: 10000) {

      edges {

        node {

          _id

          assignment {

            _id

            dueDateRequired

            name

            assignmentGroup {

              _id

              name

            }

          }

          grade

          gradedAt

          gradingStatus

          score

          user {

            _id

            email

            name

            sisId

          }

          excused

          late

          missing

          state

          submissionStatus

          submittedAt

          attachment {

            url

          }

          attachments {

            url

          }}}}}}

Here is the result I get for a sample url when I post the request independently: 

https:/[school name].instructure.com/files/115991/download?download_frd=1

Here is the result I get for a sample url when I send the query via the garphiQL: 

https://[schoolName].instructure.com/files/120020/download?download_frd=1&verifier=[verifier]

Since the major difference is in the way the authentication works, I was hoping you could help me understand what can I do to fix it?

[ben_reed]

i have also run into this issue! my guess is that it is happening because graphiql uses oauth but when i run my query from a script, i'm using a token. urls don't seem to have verifiers when you use graphql with tokens. is there something we can do to generate a verifier from a token?

it appears https://github.com/instructure/canvas-lms/blob/master/app/graphql/types/file_type.rb#L65 is the culprit.