feat: Add CSRF prevention plugin (#13)

chanzuckerberg · Dec 7, 2023 · 64c8215 · 64c8215
1 parent b25922a
commit 64c8215
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 1 deletion.
diff --git a/.meshrc.yaml b/.meshrc.yaml
@@ -6,7 +6,6 @@ sources:
         source: ./sources/czid-schema.graphql
         operationHeaders:
           Cookie: "{context.headers['cookie']}"
-          "X-CSRF-Token": "{context.headers['x-csrf-token']}"
   - name: CZIDREST
     handler:
       jsonSchema:
@@ -207,6 +206,9 @@ additionalTypeDefs: |
   }
 additionalResolvers:
   - ./resolvers.ts
+plugins:
+  - csrfPrevention:
+      requestHeaders: ['x-graphql-yoga-csrf']
 serve:
   port: 4444
   endpoint: "/graphqlfed"

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -22,6 +22,7 @@
     "@graphql-mesh/cli": "^0.87.15",
     "@graphql-mesh/graphql": "^0.95.7",
     "@graphql-mesh/json-schema": "^0.95.10",
+    "@graphql-yoga/plugin-csrf-prevention": "^3.0.0",
     "graphql": "^16.8.1"
   },
   "overrides": {}