It is not a bug report but a question.

I have a instrumentation.beginExecution implementation that checks the security context of the request and throws an AbortExecutionException if it is not found in the request or expired. That works fine for me except for the fact that I have the other instrumentation with instrumentExecutionResult that adds some generic request and environment metadata to the "extensions" node of the response. When AbortExecutionException is thrown it doesn't get called because currently, the AbortExectionException catch clause creates an ExecutionResult from the exception and just returns it.

My question is, shouldn't instrumentation.instrumentExecutionResult be called on the result in the case of caught AbortExecutionException?

See graphql/GraphQL.java:440-450