Strapi (v4) should handle GraphQL queries over GET HTTP requests

[daniele-orlando]

Bug report

Required System information

• Strapi version: 4.15.5

Describe the bug

In Strapi 4, GraphQL queries sent over HTTP GET requests receive a Forbidden access error.
Everything works as expected running the same queries over POST requests.

The GraphQL endpoint is /graphql and serves successfully POST queries/mutations and the Playground Web Interface.

Steps to reproduce the behavior

1. Open a browser console
2. Run

fetch("https://<HOST>/graphql?query=query%7Bpages%7Bdata%7Bid%20attributes%7Bslug%7D%7D%7D%7D", {
  "method": "GET",
}).then(it => it.json()).then(console.log)

Expected behavior

I should receive the GraphQL data as response.

Actual behavior

I receive the error:

{
    "errors": [
        {
            "message": "Forbidden access",
            "extensions": {
                "error": {
                    "name": "ForbiddenError",
                    "message": "Forbidden access",
                    "details": {}
                },
                "code": "FORBIDDEN"
            }
        }
    ],
    "data": {
        "offers": null
    }
}

Additional context

The issue is related to this portion of code that skips the authentication logic.

strapi/packages/plugins/graphql/server/bootstrap.js

Line 110 in dc96169

if (ctx.request.method === 'GET') return next();

Removing this block of code, the GET requests work as expected and the Playground is still reachable on the same endpoint.

-          // allow graphql playground to load without authentication
-          if (ctx.request.method === 'GET') return next();

[gauravruhela07]

@daniele-orlando I want to work on this issue, can you please assign it to me? Thanks.

[github-actions]

This is a templated message

Hello @daniele-orlando,

First thank you for reporting this feature need.
To manage feature requests and the Strapi roadmap, we are using Canny.
You will be able to access the Public Roadmap here: https://feedback.strapi.io.

In your message, please mention the URL of this thread in case some messages are posted there. But the most important is to have your feedback posted on our feedback/roadmap site.
The product team is reading EVERY comment, that really helps us to develop the project in the right direction. We are keeping all feature requests and project insights in one place, our feedback website.

In order to keep our GitHub issues clean and for valid bug reports this issue will be marked as closed, but please feel free to continue the discussion with other community members here.

Thank you for your insight and have a good day.