Add docs for the CSRF prevention plugin #1060

SimonSapin · 2022-05-16T11:11:38Z

The plugin was added in #1006

Docs are imported from Apollo Server’s own docs and adapted.

netlify · 2022-05-16T11:11:45Z

✅ Deploy Preview for apollo-router-docs ready!

Name	Link
🔨 Latest commit	`7ac52bc`
🔍 Latest deploy log	https://app.netlify.com/sites/apollo-router-docs/deploys/6283c74089f1ed0009cc1c41
😎 Deploy Preview	https://deploy-preview-1060--apollo-router-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

github-actions · 2022-05-16T11:11:53Z

@SimonSapin your pull request is missing a changelog!

SimonSapin · 2022-05-16T11:13:49Z

docs/source/configuration/csrf.mdx

+
+Note that all HTTP header names are case-insensitive.
+
+> CSRF prevention is only applied to requests that will execute GraphQL operations, not to requests that would load [landing pages](../api/plugin/landing-pages) or run [health checks](../monitoring/health-checks).)


This probably needs change, at least for fixing the links.

Does the router have a landing page, health checks, or anything else that’s not GraphQL requests? Do these go through plugins?

Yes, we have other routes. Looking at this code, for health check, landing page and graphql endpoint the request first goes through CORS, then plugins. While for plugin specific endpoint, the request goes through directly:

router/apollo-router/src/axum_http_server_factory.rs

Lines 101 to 132 in f7fc365

.route(

&graphql_endpoint,

get({

let display_landing_page = configuration.server.landing_page;

move |host: Host,

service: Extension<BufferedService>,

http_request: Request<Body>| {

handle_get(host, service, http_request, display_landing_page)

}

})

.post(handle_post),

)

.layer(

TraceLayer::new_for_http()

.make_span_with(PropagatingMakeSpan::new())

.on_response(|resp: &Response<_>, _duration: Duration, span: &Span| {

if resp.status() >= StatusCode::BAD_REQUEST {

span.record(

"otel.status_code",

&opentelemetry::trace::StatusCode::Error.as_str(),

);

} else {

span.record(

"otel.status_code",

&opentelemetry::trace::StatusCode::Ok.as_str(),

);

}

}),

)

.route("/.well-known/apollo/server-health", get(health_check))

.layer(Extension(boxed_service))

.layer(cors);

I’ve removed the note for now and opened #1081 to follow up.

abernix · 2022-05-17T08:19:06Z

This closes #1039, right?

SimonSapin · 2022-05-17T08:23:45Z

Oh indeed. I’ve added the magic keyword in the PR description.

o0Ignition0o

This looks great, congratulations! 🎉

SimonSapin requested a review from StephenBarlow as a code owner May 16, 2022 11:11

SimonSapin commented May 16, 2022

View reviewed changes

bnjjj approved these changes May 16, 2022

View reviewed changes

abernix linked an issue May 17, 2022 that may be closed by this pull request

CSRF plugin: Update documentation #1039

Closed

o0Ignition0o approved these changes May 17, 2022

View reviewed changes

SimonSapin force-pushed the simon/csrf-docs branch from 4e4d742 to 8884b78 Compare May 17, 2022 15:53

SimonSapin mentioned this pull request May 17, 2022

CSRF prevention for non-GraphQL requests? #1081

Closed

Add docs for the CSRF prevention plugin

7ac52bc

SimonSapin force-pushed the simon/csrf-docs branch from 8884b78 to 7ac52bc Compare May 17, 2022 16:03

SimonSapin enabled auto-merge (squash) May 17, 2022 16:04

SimonSapin merged commit c6dce05 into main May 17, 2022

SimonSapin deleted the simon/csrf-docs branch May 17, 2022 16:21

BrynCooke added this to the v0.9.1 milestone May 20, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add docs for the CSRF prevention plugin #1060

Add docs for the CSRF prevention plugin #1060

SimonSapin commented May 16, 2022 •

edited

Loading

netlify bot commented May 16, 2022 •

edited

Loading

github-actions bot commented May 16, 2022

SimonSapin May 16, 2022

Geal May 16, 2022

SimonSapin May 17, 2022

abernix commented May 17, 2022

SimonSapin commented May 17, 2022

o0Ignition0o left a comment


		Note that all HTTP header names are case-insensitive.

		> CSRF prevention is only applied to requests that will execute GraphQL operations, not to requests that would load [landing pages](../api/plugin/landing-pages) or run [health checks](../monitoring/health-checks).)

	.route(
	&graphql_endpoint,
	get({
	let display_landing_page = configuration.server.landing_page;
	move \|host: Host,
	service: Extension<BufferedService>,
	http_request: Request<Body>\| {
	handle_get(host, service, http_request, display_landing_page)
	}
	})
	.post(handle_post),
	)
	.layer(
	TraceLayer::new_for_http()
	.make_span_with(PropagatingMakeSpan::new())
	.on_response(\|resp: &Response<_>, _duration: Duration, span: &Span\| {
	if resp.status() >= StatusCode::BAD_REQUEST {
	span.record(
	"otel.status_code",
	&opentelemetry::trace::StatusCode::Error.as_str(),
	);
	} else {
	span.record(
	"otel.status_code",
	&opentelemetry::trace::StatusCode::Ok.as_str(),
	);
	}
	}),
	)
	.route("/.well-known/apollo/server-health", get(health_check))
	.layer(Extension(boxed_service))
	.layer(cors);

Add docs for the CSRF prevention plugin #1060

Add docs for the CSRF prevention plugin #1060

Conversation

SimonSapin commented May 16, 2022 • edited Loading

netlify bot commented May 16, 2022 • edited Loading

✅ Deploy Preview for apollo-router-docs ready!

github-actions bot commented May 16, 2022

SimonSapin May 16, 2022

Choose a reason for hiding this comment

Geal May 16, 2022

Choose a reason for hiding this comment

SimonSapin May 17, 2022

Choose a reason for hiding this comment

abernix commented May 17, 2022

SimonSapin commented May 17, 2022

o0Ignition0o left a comment

Choose a reason for hiding this comment

SimonSapin commented May 16, 2022 •

edited

Loading

netlify bot commented May 16, 2022 •

edited

Loading