You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you set **Enable introspection** and **Enable field suggestions** for production systems the information they provide can be used by malicious actors to reverse-engineer your GraphQL schema and execute arbitrary operations.
25
25
26
-
**Enable introspection** allows you to query the schema and discover the available queries, mutations, subscriptions, types and fields in the GraphQL API.
26
+
**Enable introspection** allows you to query the schema and discover the available queries, mutations, subscriptions, types and fields in the GraphQL API.
27
27
28
28
**Enable field suggestions** provides suggestions that hint towards GraphQL typos.
29
29
Even with just field suggestions enabled, it is possible for a malicious actor to discover your entire schema.
@@ -32,9 +32,9 @@ Even with just field suggestions enabled, it is possible for a malicious actor t
32
32
. Type definitions
33
33
+
34
34
This is where you describe the graph database in the AuraDB that the GraphQL API will be used with.
35
-
The Type Definitions are the same as those used with Neo4j GraphQL Library with the exception that custom resolvers cannot be used.
35
+
The Type Definitions are the same as those used with Neo4j GraphQL Library with the exception that custom resolvers cannot be used.
36
36
+
37
-
If you already have data in the AuraDB, a quick way to obtain Type Definitions is to use the https://graphql-toolbox.neo4j.io[Neo4j GraphQL Toolbox]. This facility has the ability to connect to an AuraDB, automatically create Type Definitions and allow GraphQL operations.
37
+
If you already have data in the AuraDB, a quick way to obtain Type Definitions is to use the https://graphql-toolbox.neo4j.io[Neo4j GraphQL Toolbox]. This facility has the ability to connect to an AuraDB, automatically create Type Definitions and allow GraphQL operations.
38
38
+
39
39
Alternatively you can write your own Type Definition from first principles by following the guidance provided in xref:index.adoc[Neo4j GraphQL Library] documention
40
40
+
@@ -51,13 +51,13 @@ This includes development environments such as node.js, which serves content on
51
51
This also holds for using web-based tooling for GraphQL APIs such as https://studio.apollographql.com/[Apollo Studio].
52
52
+
53
53
This is not needed if a non-browser-based application is using the GraphQL API as CORS does not apply to those.
54
-
For example, if you are trying out GraphQL operations using cURL.
54
+
For example, if you are trying out GraphQL operations using cURL.
55
55
+
56
56
[NOTE]
57
57
====
58
58
The URL entered in the CORS policy must be an exact match.
59
59
For example, http://localhost is not the same as http://localhost:3000/.
60
-
Wildcards are not supported.
60
+
Wildcards are not supported.
61
61
====
62
62
+
63
63
To add a CORS policy entry, enter the exact URL, including HTTP/S and any port number, in the **Origin box**.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/aura-graphql/api-update.adoc
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ When the data API has a status of "Ready", the changes have been applied.
26
26
There are three main commands used by the Aura CLI to modify a GraphQL API:
27
27
28
28
. `update`: Modify the general settings of a GraphQL Data API.
29
-
. `cors-policy`: Change the Cross-Origin Resource Sharing (CORS) policy.
29
+
. `cors-policy`: Change the Cross-Origin Resource Sharing (CORS) policy.
30
30
. `auth-provider`: Manage the authentication providers used by the GraphQL API.
31
31
32
32
@@ -43,7 +43,7 @@ The Aura CLI does not ask for confirmation and processes a command immediately.
43
43
=== Looking up the IDs
44
44
45
45
. Find the ID of the AuraDB.
46
-
+
46
+
+
47
47
Display a list of AuraDBs in a table:
48
48
+
49
49
[source, bash, indent=0]
@@ -61,7 +61,7 @@ Using the AuraDB ID, list any GraphQL API that it may have:
61
61
----
62
62
aura-cli data-api graphql list --instance-id YOUR_AURA_INSTANCE_ID
63
63
----
64
-
+
64
+
+
65
65
From that table, locate the GraphQL API you want to modify and make a note of its ID.
66
66
67
67
@@ -72,7 +72,7 @@ Using the IDs of both AuraDB and the GraphQL API, this is achieved with:
72
72
73
73
[source, bash, indent=0]
74
74
----
75
-
aura-cli data-api graphql get YOUR_GRAPHQL_API_ID --instance-id YOUR_AURA_INSTANCE_ID
75
+
aura-cli data-api graphql get YOUR_GRAPHQL_API_ID --instance-id YOUR_AURA_INSTANCE_ID
76
76
----
77
77
78
78
@@ -108,7 +108,7 @@ The authentication method is stored as an authentication provider.
108
108
109
109
There are advantages and disadvantages to both types.
110
110
API keys are quickly set up but do not allow for access control and should not be used within a user-facing client application.
111
-
JWKS (JSON Web Key Sets) authentication providers require an external identity provider but allow for fine-grained rules around authentication and authorization as part of a GraphQL API type definitions.
111
+
JWKS (JSON Web Key Sets) authentication providers require an external identity provider but allow for fine-grained rules around authentication and authorization as part of a GraphQL API type definitions.
112
112
113
113
[CAUTION]
114
114
====
@@ -121,17 +121,17 @@ We recommend you to use JWKS authentication providers in user-facing client appl
121
121
+
122
122
[source, bash, indent=0]
123
123
----
124
-
aura-cli data-api graphql auth-provider list --data-api-id YOUR_GRAPHQL_API_ID --instance-id YOUR_AURA_INSTANCE_ID
124
+
aura-cli data-api graphql auth-provider list --data-api-id YOUR_GRAPHQL_API_ID --instance-id YOUR_AURA_INSTANCE_ID
125
125
----
126
126
+
127
127
- Get the details of a specific authentication provider:
128
128
+
129
129
[source, bash, indent=0]
130
130
----
131
-
aura-cli data-api graphql auth-provider get YOUR_AUTH_PROVIDER_ID --data-api-id YOUR_GRAPHQL_API_ID --instance-id YOUR_AURA_INSTANCE_ID
131
+
aura-cli data-api graphql auth-provider get YOUR_AUTH_PROVIDER_ID --data-api-id YOUR_GRAPHQL_API_ID --instance-id YOUR_AURA_INSTANCE_ID
132
132
----
133
133
+
134
-
- Add a new API key.
134
+
- Add a new API key.
135
135
You can create a new API key and mark it as disabled to prevent its use.
136
136
To do that, add `--disabled` to the command.
137
137
It is only possible to enable the key via the Console.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/aura-graphql/index.adoc
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,4 +2,4 @@
2
2
3
3
Welcome to GraphQL for Neo4j AuraDB.
4
4
5
-
If you would like to provide feedback, use our `#graphql` channel on our link:https://discord.gg/M8mTADEJ[Discord Community], or our link:https://community.neo4j.com/c/drivers-stacks/graphql/33[forums] to report issues, suggest improvements, or ask questions.
5
+
If you would like to provide feedback, use our `#graphql` channel on our link:https://discord.gg/M8mTADEJ[Discord Community], or our link:https://community.neo4j.com/c/drivers-stacks/graphql/33[forums] to report issues, suggest improvements, or ask questions.
0 commit comments