DQL queries need to respect GraphQL @auth rules

[gotjoshua]

well yes a lot is possible with extra layers,
i also already set up traefik to block the DQL query endpoint… but…

I fully agree with this sentiment:

@amaster507

There needs to be some built in security service besides enterprise ACL to block ANYONE from just firing up ratel and pointing it at my :8080/ endpoint and having full access bypassing the GraphQL endpoint entirely.

for me this could be as simple as an alpha command line flag something like :
--disable-dql-endpoints or more fine grained:
--disable-dql-query --disable-dql-alter etc…

and i don’t quite agree with this sentiment:

@MichelDiz

For me, reverse proxies are the holy grail.

although I do indeed respect traefik and will use that technique if nothing else is possible.

some references to proposals from the previous thread:

@pawan

Maybe we could also support starting Dgraph in GraphQL only mode which disables these endpoints by default so that the user doesn’t have to do this.

@pawan

Another solution here could be that we apply poor man’s Auth to query and mutate endpoint as well. It’s already applied to Admin operations but can also be used to secure the /query endpoint.

Is there any movement on these possibilities in the core team?