API 平台 GraphQL 安全性

Question

So I'm using API platform in my Symfony 4 project, and I've read that it supports graphQl, so I set up an access control in security.yml to allow users to access graphQl API:

- { path: ^/api/graphql, roles: IS_AUTHENTICATED_ANONYMOUSLY }

And in each entity I have access controls for itemOperations and collectinOperations. Example:

 * @ApiResource(
 *     itemOperations={
 *         "get"={
 *             "access_control"="is_granted('ROLE_ADMIN')"
 *         }
 *     },
 *     collectionOperations={
 *         "get"={
 *             "access_control"="is_granted('ROLE_ADMIN')"
 *         }
 *     }
 * )

But issue is, any user can access this entity through graphQL, because graphQL ignores the access controls for these operations. Is there a way to force graphQL to follow these rules?

Answer 1

itemOperations and collectionOperations are not related to GraphQL but only to REST.

You need to add access controls in GraphQL operations or, if you want to target REST and GraphQL (without distinguishing operations though), you can add it as an attribute .

Also, access_control is deprecated. You should use security instead.

You can also read this documentation: https://api-platform.com/docs/core/graphql/#security