GraphQL issue with CSRF #7182

arjenvri · 2021-09-04T20:48:24Z

arjenvri
Sep 4, 2021

I am trying to use the GraphQL with Netbox 3.0.1.

Although the RESTAPI and graphene explorer work fine, i continue to run into CSRF errors.
For example

curl -H "Authorization: Token 1234567891234567891234567891234567891234" -H "Content-Type: application/json" -H "Accept: application/json" http://127.0.0.1/graphql/ --data '{"query": "query { site_list(status: "active") { name } }"}'

Results in:
You are seeing this message because this site requires a CSRF cookie when submitting forms

I have already set the ALLOWED_HOSTS list to *, but that doesnt make any difference.

Answered by arjenvri

Sep 9, 2021

Fix had been implemented in ad7b8a9

View full answer

candlerb · 2021-09-05T08:31:53Z

candlerb
Sep 5, 2021

I see the same. I'm unable to make GraphQL work using the curl sample query shown in the documentation, either via the proxy or to localhost:8001 (direct to gunicorn), with the same CSRF error as you.

I get the same with or without a Token (in my home instance I have EXEMPT_VIEW_PERMISSIONS = ['*'] which means I don't need a token for normal API read queries)

tcpdump shows:

>>> POST /graphql/ HTTP/1.1
Host: localhost:8001
User-Agent: curl/7.68.0
Authorization: Token <snip>
Content-Type: application/json
Accept: application/json
Content-Length: 69

{"query": "query {circuits(status:\"active\" {cid provider {name}}}"}

<<< HTTP/1.1 403 Forbidden
Server: gunicorn
Date: Sun, 05 Sep 2021 08:29:58 GMT
Connection: keep-alive
Content-Type: text/html
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Content-Length: 1382
Vary: Origin

<!DOCTYPE html>
<html lang="en">
<head> ... various stuff CSS ... </head>
<body>
<div id="summary">
  <h1>Forbidden <span>(403)</span></h1>
  <p>CSRF verification failed. Request aborted.</p>


  <p>You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.</p>
  <p>If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for ...same-origin... requests.</p>

</div>

<div id="explanation">
  <p><small>More information is available with DEBUG=True.</small></p>
</div>

</body>
</html>

3 replies

arjenvri Sep 5, 2021
Author

I am sure this is more a @jeremystretch question, but i wonder if a csrf_exempt should be implemented for graphql.

This is one of the suggestions mentioned in the graphene-django docs.

https://github.com/graphql-python/graphene-django/blob/main/docs/installation.rst

candlerb Sep 5, 2021

Others have apparently had it working though (e.g. #7128). I wonder if they were using a browser-based GraphQL client rather than talking directly to the API.

candlerb Sep 5, 2021

i wonder if a csrf_exempt should be implemented for graphql

I also wonder how /api/ deals with this. I see in /opt/netbox/venv/lib/python3.8/site-packages/rest_framework/views.py, classmethod APIView.as_view() has return csrf_exempt(view) - i.e. maybe this is handled under-the-hood by djangorestframework.

arjenvri · 2021-09-09T16:26:08Z

arjenvri
Sep 9, 2021
Author

Fix had been implemented in ad7b8a9

8 replies

candlerb Sep 9, 2021

I added the missing right-hand parenthesis from the query:

# curl -X GET -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" http://localhost:8001/graphql/ --data '{"query": "query {circuits(status:\"active\") {cid provider {name}}}"}'
{"errors":[{"message":"Cannot query field \"circuits\" on type \"Query\". Did you mean \"circuit\", \"circuit_list\" or \"circuit_type\"?","locations":[{"line":1,"column":8}]}]}

EDIT: after changing circuits to circuit_list it's OK:

# curl -X GET -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" http://localhost:8001/graphql/ --data '{"query": "query {circuit_list(status:\"active\") {cid provider {name}}}"}'
{"data":{"circuit_list":[{"cid":...etc

jeremystretch Sep 9, 2021
Maintainer

Sorry, my mistake! I lost track of our releases. v3.0.2 was released yesterday; the fix will be included in v3.0.3.

jeremystretch Sep 9, 2021
Maintainer

Also, the example query should read circuit_list(...), not circuits(...). I pushed a fix to the documentation earlier today for that.

candlerb Sep 9, 2021

Aside: perhaps GET queries should be disabled for graphql? Or are only non-mutating queries accepted via GET?

Otherwise it might allow someone to mutate data in Netbox via clickjacking.

jeremystretch Sep 9, 2021
Maintainer

It's a good point. We currently don't support any mutations through the GraphQL API, though that could change in the future.

GraphQL issue with CSRF #7182

Uh oh!

Uh oh!

arjenvri Sep 4, 2021

Replies: 2 comments · 11 replies

Uh oh!

Uh oh!

candlerb Sep 5, 2021

Uh oh!

arjenvri Sep 5, 2021 Author

Uh oh!

candlerb Sep 5, 2021

Uh oh!

candlerb Sep 5, 2021

Uh oh!

arjenvri Sep 9, 2021 Author

Uh oh!

Uh oh!

candlerb Sep 9, 2021

Uh oh!

jeremystretch Sep 9, 2021 Maintainer

Uh oh!

Uh oh!

jeremystretch Sep 9, 2021 Maintainer

Uh oh!

candlerb Sep 9, 2021

Uh oh!

jeremystretch Sep 9, 2021 Maintainer

arjenvri
Sep 4, 2021

Replies: 2 comments 11 replies

candlerb
Sep 5, 2021

arjenvri Sep 5, 2021
Author

arjenvri
Sep 9, 2021
Author

jeremystretch Sep 9, 2021
Maintainer

jeremystretch Sep 9, 2021
Maintainer

jeremystretch Sep 9, 2021
Maintainer