Closed stefa98 closed 2 weeks ago
@stefa98 for authorized/authenticated uses through Restricted Site Access, are they blocked from WPGraphQL functionality?
@jeffpaul I haven't tested, but public access to the WPGraphQL endpoint is blocked with the plugin active
??
@stefa98 is it possible for you to pass custom HTTP headers with the graphQL request?
If yes, then you can pass a header with your request like:
X-RSA-GRAPHQL-HEADER
with some secret value such as some_secret_value
.
An example request with cURL:
curl --location 'http://osp.mylocal/graphql' \
--header 'X-RSA-GRAPHQL-HEADER: some_secret_value' \
--form 'query="{
generalSettings {
url
title
}
}
"'
Then on the server side, you can use the following filter to allow access for graphQL requests:
add_filter( 'restricted_site_access_is_restricted', function ( $is_restricted ) {
// Custom trusted headers; array key should be the header name and value should be the header value.
$allowed_custom_trusted_headers = array(
'HTTP_X_RSA_GRAPHQL_HEADER' => 'some_secret_value' // Replace header and value with your custom details.
);
// Ensure trusted headers exist in request.
if ( ! array_intersect_key( $_SERVER, $allowed_custom_trusted_headers ) ) {
return $is_restricted;
}
// Ensure all the trusted headers have the correct value.
foreach ( $allowed_custom_trusted_headers as $header => $value ) {
if ( $value !== $_SERVER[ $header ] ) { // phpcs:ignore
// Return true to apply ip restriction.
return true;
}
}
// Return false to bypass ip restriction.
return false;
} );
We're closing this issue since we haven't heard from you in a while. Feel free to reopen if needed.
Describe the bug
With Restricted Site Access active, the GraphQL api is not available. I ask if possible to include compatibility with WPGraphQL and not to block access to said Api
Steps to Reproduce
Install WPGraphQL Instal Restricted Site Access Use GraphQL
Screenshots, screen recording, code snippet
No response
Environment information
No response
WordPress information
No response
Code of Conduct