Handle CSRF on GraphQL endpoint

CentreForDigitalHumanities / lettercraft

Lettercraft & Epistolary Performance in Medieval Europe

BSD 3-Clause "New" or "Revised" License

1 stars 0 forks source link

Handle CSRF on GraphQL endpoint #82

Open XanderVertegaal opened 3 weeks ago

XanderVertegaal commented 3 weeks ago

Currently, /api/graphql is exempt from CSRF.

We could solve this by sending CSRF-tokens along with every request, or by implementing a good user/permission system, which ensures that non-authenticated users are not able to query/mutate anything.