• Resolved therealgilles

    (@chamois_blanc)


    I am looking at wp-graphql, exploring if it would be useful for one of my projects where I know the REST API is sending way more information than I need, and some that I had to manually add.

    I was looking at the documentation and ended up on the security page, which I found empty, which does not inspire confidence. I hope the developer (team?) will soon have time to add it. Thank you!

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Jason Bahl

    (@jasonbahl)

    @chamois_blanc Thanks for the callout here!

    I’m working on adding this page right now. Do you have any specific questions you’d like addressed here?

    Some topics I plan to cover on the page:

    – GraphQL Schema Introspection
    – Access Control Rights
    – WPGraphQL Model Layer
    – Authentication & Authorization
    – Mutations

    If you have anything specific you had questions about, please let us know!

    Plugin Author Jason Bahl

    (@jasonbahl)

    @chamois_blanc I wrote up some docs about WPGraphQL Security here: https://www.wpgraphql.com/docs/security/

    If you have any specific questions, please let us know!

    Thread Starter therealgilles

    (@chamois_blanc)

    Hi Jason,

    Thank you for your replies and for quickly adding documentation to the page. It is quite useful.

    I have a few questions:
    1) I am new to grapql and wp-graphql. As far as I can see, wp-graphql seems to rely on the WP Query at its core. Is that right? If a plugin has put together its own ORM on top of the WP Query, it does not seem possible (or a good idea) to adapt wp-graphql to use it. Is that correct?

    I will be looking at how the WooCommerce wp-graphql extension is done. The plugin I am concerned about is the Events Calendar (TEC). I saw some developers have started writing an extension for it but it’s not quite far enough along, and the TEC plugin developers have invested heavily in their ORM.

    2) The “Access Control Rights” section mentions that unpublished users will be skipped just like the REST API does is. I have an ecommerce store with a separate React-based app, which needs to query all users (and the site does not have posts). The REST API provides the rest_user_query filter that allows me to change the query and return all users. Does such a filter exist for wp-graphql?

    3) My React-based app already uses multiple types of authentication with WordPress:
    ? I use a wp-oauth2 server plugin for initial login.
    ? I use the ecommerce REST API client id/secret authentication to access everything ecommerce related (I use multiple authentication pairs because some of my product prices are user-role based).
    ? I use WP application password authentication for access to users information and querying calendar events (originally via a plugin and now integrated into WP core). I could probably use the oauth2 token eventually.

    The documentation suggests they “should” all work with wp-graphql. I haven’t had a chance to give it a try yet. I’m guessing that wp-graphql is using WP regular authentication functions so it should all work. Am I understanding this right?

    Thank you for providing this tool for the community and for the support!

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Security documentation page is empty’ is closed to new replies.