search

himanshusr / graphql-react

A simple GraphQL ToDo App
0 stars 0 forks source link

Is this secure? #1

Open amitava82 opened 1 year ago

amitava82 commented 1 year ago

https://github.com/himanshusr/graphql-react/blob/20f83806eecc298cf858a72b213a30b1bbc290ee/src/components/App.js#L11

I can see your secret in header dz6B8m6erQ930wncSC41sBvVQuXrIT3HkANuxW82U3lY1k9MGfLEWQvoOKR0e32Q. Now I can do anything on the DB. How do you think it can be secured?

himanshusr commented 1 year ago

By creating non-admin accounts in the Hasura backend, adding the required permissions, and adding an auth flow using JWT @amitava82