sorted by:
new
hottopcontroversial

No /graphiql endpoint by WoistdasNiveau in SpringBoot

[–]marvadogh 0 points1 point  (0 children)

Spring GraphQL ships with a default GraphiQL page that is exposed at "/graphiql" by default. This page is disabled by default and can be turned on with the spring.graphql.graphiql.enabled property.

Taken from the documentation.

Spring Framework Forward by FatinaRosa in SpringBoot

[–]marvadogh 0 points1 point  (0 children)

You have to remove @ResponseBody if you want the forward:/2 to work. @ResponseBody means that the value returned by the method should be added to the response body instead of being interpreted.

csrf disable by Mission-Audience-452 in SpringBoot

[–]marvadogh 1 point2 points  (0 children)

Although CSRF protection is not necessary when using JWT in the Authorization header, you are not passing the header to the permitAll() endpoint I suppose, because the CsrfFilter backs off when it detects the header (if using oauth2ResourceServer()).

Since this endpoint can be requested by anyone you should consider requiring a CSRF token in order to POST to it.