Merge pull request #861 from terrestris/graphql-public-access

Anonymous access to graphql interface
terrestris · May 14, 2024 · 38b45cd · 38b45cd
2 parents 9a9d2fe + 58d1c68
commit 38b45cd
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/shogun-config/src/main/java/de/terrestris/shogun/config/DefaultWebSecurityConfig.java b/shogun-config/src/main/java/de/terrestris/shogun/config/DefaultWebSecurityConfig.java
@@ -47,8 +47,7 @@ default void customHttpConfiguration(HttpSecurity http) throws Exception {
                     "/graphiql/**"
                 )
                     .permitAll()
-                // Enable anonymous read access to entity endpoints
-                // will be secured via permission evaluators
+                // Enable anonymous read access to entity endpoints (secured via permission evaluators)
                 .requestMatchers(
                     HttpMethod.GET,
                     "/applications",
@@ -61,6 +60,12 @@ default void customHttpConfiguration(HttpSecurity http) throws Exception {
                     "/imagefiles/*"
                 )
                 .permitAll()
+                // Enable anonymous access to graphql (secured via permission evaluators)
+                .requestMatchers(
+                    HttpMethod.POST,
+                    "/graphql"
+                )
+                .permitAll()
                 .requestMatchers(
                     "/actuator/**",
                     "/cache/**",