Can anyone explain how security works on graphql on venia pwa? I don't see any tokens or sessions or something like this at Venia. So any developer can create a graphql query and get all data from my site?

  • means all your data show on pwa site from magento 2 site Commented Mar 15 at 12:32
  • @mohitvamja For example i have venia www.pwa.com and magento www.magento.com, i am an external user that dont know credentials, can i use graphql query via url www.magento.com/graphql and get all data that i need ? If i can't so why? How graphql security is works? is that my question:D
    – Erik Kis
    Commented Mar 15 at 12:39
  • i have created module you can understand better. Commented Mar 15 at 12:42
  • @mohitvamja and where i can see it ?
    – Erik Kis
    Commented Mar 15 at 12:49
  • wait i will share this now can you used discord.? Commented Mar 15 at 12:53

1 Answer 1


i have alredy one module for my custom grid in backend site so I will share my screenshot.

enter image description here enter image description here

now I will share my code for graphql related.


<?xml version="1.0" ?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
<module name="Test_Uiform" setup_version="1.0.0">
        <module name="Magento_GraphQl"/>
        <module name="Magento_Backend"/>


type Query {
getDemoLink : [getAllGridDemo] @resolver( class: 
 "Test\\Uiform\\Model\\Resolver\\GridRecords") @doc(description: "Get 
 All  Banners")

type getAllGridDemo {
blog_id : Int  @doc(description: "Blog Id"),
name : String  @doc(description: "name"),
status : String  @doc(description: "Status"),
category : String  @doc(description: "category"),
image : String  @doc(description: "image"),
cars : String  @doc(description: "image")



namespace Test\Uiform\Model\Resolver;

use Magento\Framework\GraphQl\Config\Element\Field;
use Magento\Framework\GraphQl\Query\ResolverInterface;
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;

class GridRecords implements ResolverInterface { private $GridRecords;

public function __construct(
) {
    $this->GridRecords = $GridRecords;

public function resolve(
    Field $field,
    ResolveInfo $info,
    array $value = null,
    array $args = null
) {
    $GridRecords = $this->GridRecords->getGridRecords();
    return $GridRecords;



namespace Web30india\Uiform\Model\Resolver\DataProvider;

class GridRecords
private $BlogFactory;

public function __construct(
      \Web30india\Uiform\Model\BlogFactory $BlogFactory
 ) {
      $this->BlogFactory = $BlogFactory;

public function getGridRecords()
    try {
        $collection = $this->BlogFactory->create()->getCollection();
        $Records = $collection->getData();
        foreach ($Records as &$record) {
            // Assuming 'status' is the key for the status field in the record
            $status = isset($record['status']) ? $record['status'] : null;

            // Check the status and set 'enable' or 'disable'
            if ($status == 1) {
                $record['status'] = 'enable';
            } else {
                $record['status'] = 'disable';

    } catch (NoSuchEntityException $e) {
        throw new GraphQlNoSuchEntityException(__($e->getMessage()), $e);
    return $Records;
please check below screenshot forhow to open graphql on browser and add your project URL.

enter image description here

here my project url => and last add graphql so you can add your project url and after end add graphql

next screen shot for run my code so plese apply query for your module data related.


enter image description here

i hope that is help for you. if you like then accept my answer and upvote.

  • thanks for your answer but, as i see, you just showed me how to use graphql, sorry but i know it :( my question is: how securty works here? if you have this data on server, i can use this graphql query and stole these data?
    – Erik Kis
    Commented Mar 15 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.