chapter-three / next-drupal

Next.js for Drupal has everything you need to build a next-generation front-end for your Drupal site: SSG, SSR, and ISR, Multi-site, Authentication, Webforms, Search API, I18n and Preview mode (works with JSON:API and GraphQL).
https://next-drupal.org
MIT License
640 stars 178 forks source link

Unpublished content is accessible in front-end #813

Open perrydrums opened 1 month ago

perrydrums commented 1 month ago

Package containing the bug

I’m not sure

Describe the bug

After following the guides on https://next-drupal.org/learn/preview-mode, I can access all content regardless if they are published or not. This has to do with the Bypass Access Control permission, but this has to be added according to the guide. I expect to only be able to visit those pages when on preview mode. (I tried incognito mode and made sure preview mode was turned off)

Expected behavior

Visiting unpublished content /blog/test-article results in a 404, except when in preview mode.

Am I doing something wrong?

Is there something I don't understand here? I followed the guide and installed the GraphQL starter projects.