You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
, an improvement was made to how relational field data is handled in subscriptions when different authorization rules apply to related models in a schema. The improvement redacts the values for the relational fields, displaying them as null or empty, to prevent unauthorized access to relational data. This redaction occurs whenever it cannot be determined that the child model will be protected by the same permissions as the parent model.
43
-
</p>
44
-
<p>
45
-
Because subscriptions are tied to mutations and the selection set provided in the result of a mutation is then passed through to the subscription, relational fields in the result of mutations must be redacted.
46
-
</p>
47
-
<p>
48
-
If an authorized end-user needs access to the redacted relational field they should perform a query to read the relational data.
49
-
</p>
50
-
<p>
51
-
Additionally, subscriptions will inherit related authorization when relational fields are set as required. To better protect relational data, consider modifying the schema to use optional relational fields.
52
-
</p>
53
-
<p>
54
-
Based on the security posture of your application, you can choose to revert to the subscription behavior before this improvement was made.
55
-
</p>
56
-
<p>
57
-
To do so, use the
58
-
<code>
59
-
subscriptionsInheritPrimaryAuth
60
-
</code>
61
-
feature flag under
62
-
<code>
63
-
graphqltransformer
64
-
</code>
65
-
in the
66
-
67
-
<code>
68
-
amplify/backend/cli.json
69
-
</code>
70
-
file.
71
-
</p>
72
-
<ul>
73
-
<li>
74
-
If enabled, subscriptions will inherit the primary model authorization rules for the relational fields.
75
-
</li>
76
-
<li>
77
-
If disabled, relational fields will be redacted in mutation response when there is a difference between auth rules between primary and related models.
, an improvement was made to how relational field data is handled in subscriptions when different authorization rules apply to related models in a schema. The improvement redacts the values for the relational fields, displaying them as null or empty, to prevent unauthorized access to relational data. This redaction occurs whenever it cannot be determined that the child model will be protected by the same permissions as the parent model.
43
+
</p>
44
+
<p>
45
+
Because subscriptions are tied to mutations and the selection set provided in the result of a mutation is then passed through to the subscription, relational fields in the result of mutations must be redacted.
46
+
</p>
47
+
<p>
48
+
If an authorized end-user needs access to the redacted relational field they should perform a query to read the relational data.
49
+
</p>
50
+
<p>
51
+
Additionally, subscriptions will inherit related authorization when relational fields are set as required. To better protect relational data, consider modifying the schema to use optional relational fields.
52
+
</p>
53
+
<p>
54
+
Based on the security posture of your application, you can choose to revert to the subscription behavior before this improvement was made.
55
+
</p>
56
+
<p>
57
+
To do so, use the
58
+
<code>
59
+
subscriptionsInheritPrimaryAuth
60
+
</code>
61
+
feature flag under
62
+
<code>
63
+
graphqltransformer
64
+
</code>
65
+
in the
66
+
67
+
<code>
68
+
amplify/backend/cli.json
69
+
</code>
70
+
file.
71
+
</p>
72
+
<ul>
73
+
<li>
74
+
If enabled, subscriptions will inherit the primary model authorization rules for the relational fields.
75
+
</li>
76
+
<li>
77
+
If disabled, relational fields will be redacted in mutation response when there is a difference between auth rules between primary and related models.
78
+
</li>
79
+
</ul>
80
+
</div>
80
81
</div>
81
82
</div>
82
83
</div>
@@ -87,50 +88,51 @@ exports[`Protected Redaction Messages should render the protected redaction mess
, an improvement was made to how relational field data is handled in subscriptions when different authorization rules apply to related models in a schema. The improvement redacts the values for the relational fields, displaying them as null or empty, to prevent unauthorized access to relational data.
121
-
</p>
122
-
<p>
123
-
This redaction occurs whenever it cannot be determined that the child model will be protected by the same permissions as the parent model.
124
-
</p>
125
-
<p>
126
-
Because subscriptions are tied to mutations and the selection set provided in the result of a mutation is then passed through to the subscription, relational fields in the result of mutations must be redacted.
127
-
</p>
128
-
<p>
129
-
If an authorized end-user needs access to the redacted relational fields, they should perform a query to read the relational data.
130
-
</p>
131
-
<p>
132
-
Additionally, subscriptions will inherit related authorization when relational fields are set as required. To better protect relational data, consider modifying the schema to use optional relational fields.
, an improvement was made to how relational field data is handled in subscriptions when different authorization rules apply to related models in a schema. The improvement redacts the values for the relational fields, displaying them as null or empty, to prevent unauthorized access to relational data.
122
+
</p>
123
+
<p>
124
+
This redaction occurs whenever it cannot be determined that the child model will be protected by the same permissions as the parent model.
125
+
</p>
126
+
<p>
127
+
Because subscriptions are tied to mutations and the selection set provided in the result of a mutation is then passed through to the subscription, relational fields in the result of mutations must be redacted.
128
+
</p>
129
+
<p>
130
+
If an authorized end-user needs access to the redacted relational fields, they should perform a query to read the relational data.
131
+
</p>
132
+
<p>
133
+
Additionally, subscriptions will inherit related authorization when relational fields are set as required. To better protect relational data, consider modifying the schema to use optional relational fields.
0 commit comments