Version 4
end of life
This version of Silverstripe CMS will not recieve any additional bug fixes or documentation updates.
Go to documentation for the most recent stable version.
Security & best practices
- Authentication
- Ensure your GraphQL api is only accessible to provisioned users
- CSRF protection
- Protect destructive actions from cross-site request forgery
- Strict HTTP method checking
- Ensure requests are GET or POST
- Recursive or complex queries
- Protecting against potentially malicious queries
- Cross-Origin Resource Sharing (CORS)
- Ensure that requests to your API come from a whitelist of origins
You are viewing docs for silverstripe/graphql 4.x. If you are using 3.x, documentation can be found in the GitHub repository
Strict HTTP method checking
According to GraphQL best practices, mutations should be done over POST, while queries have the option
to use either GET or POST. By default, this module enforces the POST request method for all mutations.
To disable that requirement, you can remove the HTTPMethodMiddleware
from the QueryHandler.
SilverStripe\GraphQL\QueryHandler\QueryHandlerInterface.default:
class: SilverStripe\GraphQL\QueryHandler\QueryHandler
properties:
Middlewares:
httpMethod: false