Restrict REST or GraphQL API to certain domains

[dominikradl]

Hi there,

did anyone manage to restrict the REST or GraphQL endpoints to certain domains? I want my decoupled frontend to be able to access it, but no one else.

I tried using the Laravel CORS config (Fruitcake middleware) but I'm still able to query all entries (inclunding unpublished entries) via local postman. Maybe I'm misunderstanding CORS or I need to write a custom middleware…

Thanks

[edalzell]

ya middleware is the answer here, if you don't want to PR into core.

[dominikradl]

Thanks, Erin!