How to disable Mutation and Subscription in Sitecore GraphQL?

Question

As per sitecore documentation, it states You can use custom authorization routines. Content endpoints can disable specific operations, so, for example, a mutation-free read-only content endpoint is possible. I'm looking for a reference or custom authorization routines which can help me disabled or denied access to GraphQL Mutation and Subscription.

Answer 1

It depends on which endpoint you are using. Once you know that, best starting point is the config. Use showconfig and/or check config files (the showconfig can guide you to the correct files) or -and even best- use the ShowConfigLayers admin tool to show the config of a ContentDelivery role. Normally that has some configuration already in place.

E.g. for an edge endpoint in a 10.2 you would find something like:

<endpoints patch:source="Sitecore.Services.GraphQL.EdgeContent.config">
  <edge type="Sitecore.Services.GraphQL.Hosting.GraphQLEndpoint, Sitecore.Services.GraphQL.NetFxHost" url="/sitecore/api/graph/edge" resolve="true">
    <url>$(url)</url>
    <enableSubscriptions>false</enableSubscriptions>
    <!--  lock down the endpoint when deployed to content delivery  -->
    <graphiql>false</graphiql>
    <enableSchemaExport>false</enableSchemaExport>
    <enableStats>false</enableStats>
    <enableCacheStats>false</enableCacheStats>
    <disableIntrospection>true</disableIntrospection>
    <allowUnauthenticatedCorsPreflight>false</allowUnauthenticatedCorsPreflight>

This config can be patched to match your needs. I haven't found a complete list of all the options here though - but it might get you started.