As per sitecore documentation, it states You can use custom authorization routines. Content endpoints can disable specific operations, so, for example, a mutation-free read-only content endpoint is possible. I'm looking for a reference or custom authorization routines which can help me disabled or denied access to GraphQL Mutation and Subscription.
It depends on which endpoint you are using. Once you know that, best starting point is the config. Use showconfig and/or check config files (the showconfig can guide you to the correct files) or -and even best- use the
ShowConfigLayers admin tool to show the config of a ContentDelivery role. Normally that has some configuration already in place.
E.g. for an edge endpoint in a 10.2 you would find something like:
<endpoints patch:source="Sitecore.Services.GraphQL.EdgeContent.config"> <edge type="Sitecore.Services.GraphQL.Hosting.GraphQLEndpoint, Sitecore.Services.GraphQL.NetFxHost" url="/sitecore/api/graph/edge" resolve="true"> <url>$(url)</url> <enableSubscriptions>false</enableSubscriptions> <!-- lock down the endpoint when deployed to content delivery --> <graphiql>false</graphiql> <enableSchemaExport>false</enableSchemaExport> <enableStats>false</enableStats> <enableCacheStats>false</enableCacheStats> <disableIntrospection>true</disableIntrospection> <allowUnauthenticatedCorsPreflight>false</allowUnauthenticatedCorsPreflight>
This config can be patched to match your needs. I haven't found a complete list of all the options here though - but it might get you started.
EnableSubscription false will help me do that. But for Mutation option there is none. We want to source data to Mobile App from web db once the content is published. We want to restrict Mutation and Subscription for the given Role and user. The impersonation option will help me do that . Just mutation is something now that needs to be look upon. Thanks for your response. Jun 16, 2022 at 22:36
1You can control mutation via normal item security, as it will impersonate the user specified on the config item. If you use extranet\anonymous then it has no write access. Jun 29, 2022 at 5:22