Question

0

166

Vistas

Make GraphQL api secure

I started using GQL with Express (It is awesome). So I have a couple questions.

How can I make GQL secure so only I can access the API and playground in general. Like Instagram. You can't access their "playground".
When I was working with rest api, I was sending tokens trough Headers to be secure. Where to put them now?

  app.use(
    "/graphql",
    graphqlHTTP({
      schema,
      graphiql: true,
    })
  )

Thank you.

about 4 years ago · Juan Pablo Isaza

2 Respuestas

Responde la pregunta

0

Responde la pregunta

Encuentra empleos remotos

Answer 1 · 2022-07-03T16:27:21.748Z

I highly suggest that you don't keep your playground open into production. A playground is a web app with its own complexity and thus its own vulnerabilities. See Hacking GraphQL Playground
Authentication is handled in GraphQL exactly the same as in REST. Actually you can even have a REST authentication over your GraphQL App. You can find a lot more information here about how to manage authentication, authorization, and access control properly in GraphQL here: Authentication, Authorization and Access Control for GraphQL

Answer 2 · 2022-07-03T16:27:21.755Z

For 1) the playground is toggled on or off with that graphiql flag you have there. As for securing it you would want to use a middle where that checks an incoming token of some sort and allows/rejects based on the verification of that token.

GraphQL works the exact same way as a REST endpoint in that respect. Tokens in the headers is the standard.

0

166

Make GraphQL api secure

Thank you.

2 Respuestas

0

0

Encuentra empleos remotos

Andres GPT