RFC: CSRF Prevention

[dotansimha]

Both Hive Gateway and Apollo Router follow the similar approaches on CSRF

The only difference is the default. By default, Hive Gateway doesn't have it, and Apollo Router has it in production mode.

The configuration is very simple. It is a list of the headers;

csrf:
   headers:
     - x-gateway-csrf

References

• https://the-guild.dev/graphql/hive/docs/gateway/other-features/security/csrf-prevention
• https://www.apollographql.com/docs/graphos/routing/security/csrf

[linear]

GWRS-114 RFC: CSRF Prevention