You need to sign in or sign up before continuing.

graphql_controller.rb

2 months ago

Skip CSRF check for query-only GraphQL requests · f6b56b32

Heinrich Lee Yu authored 2 months ago

When a GraphQL request only contains queries, it can be requested using
GET which skips CSRF checks.

We can skip the same checks even if they are requested with a POST since
these should not mutate any data.

Verified

f6b56b32

History

Skip CSRF check for query-only GraphQL requests

Heinrich Lee Yu authored 2 months ago

When a GraphQL request only contains queries, it can be requested using
GET which skips CSRF checks.

We can skip the same checks even if they are requested with a POST since
these should not mutate any data.

Code owners

Assign users and groups as approvers for specific file changes. Learn more.