0

Can anyone explain how security works on graphql on venia pwa? I don't see any tokens or sessions or something like this at Venia. So any developer can create a graphql query and get all data from my site?

7
  • means all your data show on pwa site from magento 2 site Mar 15 at 12:32
  • @mohitvamja For example i have venia www.pwa.com and magento www.magento.com, i am an external user that dont know credentials, can i use graphql query via url www.magento.com/graphql and get all data that i need ? If i can't so why? How graphql security is works? is that my question:D
    – Erik Kis
    Mar 15 at 12:39
  • i have created module you can understand better. Mar 15 at 12:42
  • @mohitvamja and where i can see it ?
    – Erik Kis
    Mar 15 at 12:49
  • wait i will share this now can you used discord.? Mar 15 at 12:53

1 Answer 1

0

i have alredy one module for my custom grid in backend site so I will share my screenshot.

enter image description here enter image description here

now I will share my code for graphql related.

/var/www/html/walletmetamask/app/code/Test/Uiform/etc/module.xml

<?xml version="1.0" ?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
<module name="Test_Uiform" setup_version="1.0.0">
    <sequence>
        <module name="Magento_GraphQl"/>
        <module name="Magento_Backend"/>
    </sequence>
</module>

/var/www/html/walletmetamask/app/code/Test/Uiform/etc/schema.graphqls

type Query {
getDemoLink : [getAllGridDemo] @resolver( class: 
 "Test\\Uiform\\Model\\Resolver\\GridRecords") @doc(description: "Get 
 All  Banners")
}

type getAllGridDemo {
blog_id : Int  @doc(description: "Blog Id"),
name : String  @doc(description: "name"),
status : String  @doc(description: "Status"),
category : String  @doc(description: "category"),
image : String  @doc(description: "image"),
cars : String  @doc(description: "image")
} 

/var/www/html/walletmetamask/app/code/Test/Uiform/Model/Resolver/GridRecords.php

<?php

namespace Test\Uiform\Model\Resolver;

use Magento\Framework\GraphQl\Config\Element\Field;
use Magento\Framework\GraphQl\Query\ResolverInterface;
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;

class GridRecords implements ResolverInterface { private $GridRecords;

public function __construct(
    \Web30india\Uiform\Model\Resolver\DataProvider\GridRecords 
$GridRecords
) {
    $this->GridRecords = $GridRecords;
}

public function resolve(
    Field $field,
    $context,
    ResolveInfo $info,
    array $value = null,
    array $args = null
) {
    $GridRecords = $this->GridRecords->getGridRecords();
    return $GridRecords;
}
}

/var/www/html/walletmetamask/app/code/Test/Uiform/Model/Resolver/DataProvider/GridRecords.php

<?php

namespace Web30india\Uiform\Model\Resolver\DataProvider;

class GridRecords
{
private $BlogFactory;

public function __construct(
      \Web30india\Uiform\Model\BlogFactory $BlogFactory
 ) {
      $this->BlogFactory = $BlogFactory;
 }

public function getGridRecords()
{
    try {
        $collection = $this->BlogFactory->create()->getCollection();
        $Records = $collection->getData();
        foreach ($Records as &$record) {
            // Assuming 'status' is the key for the status field in the record
            $status = isset($record['status']) ? $record['status'] : null;

            // Check the status and set 'enable' or 'disable'
            if ($status == 1) {
                $record['status'] = 'enable';
            } else {
                $record['status'] = 'disable';
            }
        }

    } catch (NoSuchEntityException $e) {
        throw new GraphQlNoSuchEntityException(__($e->getMessage()), $e);
    }
    return $Records;
}
}
please check below screenshot forhow to open graphql on browser and add your project URL.

enter image description here

here my project url => http://127.0.0.1/walletmetamask/pub and last add graphql http://127.0.0.1/walletmetamask/pub/graphql so you can add your project url and after end add graphql

next screen shot for run my code so plese apply query for your module data related.

{
  getDemoLink{
    blog_id
    name
    status
    category
    image
    cars
 }  
}

enter image description here

i hope that is help for you. if you like then accept my answer and upvote.

1
  • thanks for your answer but, as i see, you just showed me how to use graphql, sorry but i know it :( my question is: how securty works here? if you have this data on server, i can use this graphql query and stole these data?
    – Erik Kis
    Mar 15 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.