Version 5
supported
Security & best practices
- CSRF protection
- Protect destructive actions from cross-site request forgery
- Authentication
- Ensure your GraphQL api is only accessible to provisioned users
- Strict HTTP method checking
- Ensure requests are GET or POST
- Cross-Origin Resource Sharing (CORS)
- Ensure that requests to your API come from a whitelist of origins
- Recursive or complex queries
- Protecting against potentially malicious queries
Strict HTTP method checking
According to GraphQL best practices, mutations should be done over POST, while queries have the option
to use either GET or POST. By default, this module enforces the POST request method for all mutations.
To disable that requirement, you can remove the HTTPMethodMiddleware
from the QueryHandler.
SilverStripe\GraphQL\QueryHandler\QueryHandlerInterface.default:
class: SilverStripe\GraphQL\QueryHandler\QueryHandler
properties:
Middlewares:
httpMethod: false