tme_317
I was wondering if you decide to use sessions (typically using cookies) to store the auth token using Absinthe.Plug :before_send option like in the example here: Access to Plug.Conn in a processing pipeline · Issue #109 · absinthe-graphql/absinthe_plug · GitHub if you open yourself up to CSRF attacks on subsequent query/mutation POST requests?
It’s simple enough to store a CSRF token in the page and submit it as a x-csrf-token header in the query/mutation for validation but not sure if it’s necessary to worry about it. Also not sure exactly how to deal with CSRF token staleness/refresh/reuse issues if needed in multiple queries/mutations on the same page. I could add a request for a new fresh token after every post as part of my GraphQL query but it’s a bit tedious and maybe there’s another better way?
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #security
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
jeremyjh
CSRF protection is recommended for all web requests types. It does not matter that the payload is a GraphQL message. By default tokens can be re-used. A typical SPA would use the token received in its initial page load for all requests until that page is refreshed again.
tme_317
Sounds good, thanks! I was thinking that was the case. Good to hear the tokens can be re-used I was thinking they were one-time use requiring constant refreshing which would add unwanted complexity… didn’t want to have to request new CSRF tokens with each mutation.