Manage security access for items with GraphQL

Question

We noticed that there is no limitation on what data can be queried, all the data in GraphQL can be retrieved within the Sitecore instance.

Any GraphQL request with the correct API Key can retrieve information like the database schema and retrieving sensitive information sensitive data like email credentials. Is it possible to restrict GraphQL queries on necessary items for the site?

What is the best way we can do to have a good security on our GraphQL Api?

Answer 1

In all the scenarios graphQL will be executed in two contexts,

1. Impersonation user context [until user is not logged-in or auth cookie not set]
2. Logged-in user context [with valid Sitecore auth cookie]

Note - Once user logged and received valid Sitecore auth cookie then whatever access the logged-in user has that will be applicable to graphQL/API key. If we want to restrict any field or item then we may need to security for that field/item at role level.

To define security for graphQL calls with just API key [without authentication] we need to set security using “Impersonation User” of an API key effectively.

For ex, if we are using “extranet\anonymous” as an impersonation user then we have to set security for this user to disable the field/item based on our need. Restrict read access for any field/item at item level or standard values level and that will be set in GraphQL as well, when executing graphQL query using extranet\anonymous user context we may not see those fields/items.

We can further extend this security for logged-in users as well based on role. [If needed]

Additionally we can also define AllowedControllers and CORS Orgin in API key level.

Also refer in your app config’s graphQL end point. You will see details of this node in .\App_Config\Sitecore\Services.GraphQL\Sitecore.Services.GraphQL.config

you may tweak the below settings to control graphQL schema. Check .\App_Config\Sitecore\Services.GraphQL\Sitecore.Services.GraphQL.Content.config or your graphQL end point for below entries.

<templates type="Sitecore.Services.GraphQL.Content.TemplateGeneration.Filters.StandardTemplatePredicate, Sitecore.Services.GraphQL.Content">
  <database>$(1)</database>
    <paths hint="list:AddIncludedPath">
    <foundation>/sitecore/templates/Foundation</foundation>
    <feature>/sitecore/templates/Feature</feature>
    <project>/sitecore/templates/Project</project>
  </paths>
  <fieldFilter type="Sitecore.Services.GraphQL.Content.TemplateGeneration.Filters.StandardFieldFilter, Sitecore.Services.GraphQL.Content">
  <exclusions hint="raw:AddFilter">
    <!-- 
      Remove system fields from the GraphQL types in the strongly typed API (e.g. 
    __Layout) Wildcards are allowed.
     -->
     <exclude name="__*" />
     <!--
     You can also exclude fields from the schema specifically by field ID
     <exclude fieldId="{8FB875EB-3AD3-44FF-87E1-998370CC3199}" />-->
  </exclusions>
 </fieldFilter>
</templates>