I have a Spring Boot-GraphQL application. I have some GraphQL endpoints in a controller. By using SecurityFilterChain, All the incoming requests must be authenticated. It works very well. My question is: How can I configure one of the GraphQL endpoints to be accessible without authentication? In REST controllers, this can be done by adding the endpoint URL to requestMatchers("/**").permitAll();. As far as I know, GraphQL endpoints do not have a feature that allows referencing them by a URL.

I would like this method to be accessible to all requests:

@QueryMapping
public List<Product> getAllProducts() {

    return productService.getAllProducts();
}

I appreciate your helps

I have a Spring Boot-GraphQL application. I have some GraphQL endpoints in a controller. By using SecurityFilterChain, All the incoming requests must be authenticated. It works very well. My question is: How can I configure one of the GraphQL endpoints to be accessible without authentication? In REST controllers, this can be done by adding the endpoint URL to requestMatchers("/**").permitAll();. As far as I know, GraphQL endpoints do not have a feature that allows referencing them by a URL.

I would like this method to be accessible to all requests:

@QueryMapping
public List<Product> getAllProducts() {

    return productService.getAllProducts();
}

I appreciate your helps

• spring
• spring-boot
• spring-security
• graphql

1 Answer 1

I found a way to solve it.

I permitted all requests to come in, In the security configuration class. Then annotated all the methods by @PreAuthorize("isAuthenticated()") which need to be protected. Then the method that should be accessible without authentication , Left it without adding the mentioned annotation.