According to this Gitbook (near the bottom), its possible to require GraphQL query authentication with Drupal Core's Basic Auth module. This allows GraphQL to authenticate against a user stored in the Drupal DB.


I created an event subscriber that adds the Basic Auth option to the route like this:

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

class RouteSubscriber extends RouteSubscriberBase {

   * {@inheritdoc}
  protected function alterRoutes(RouteCollection $collection) {
    if ($route = $collection->get('graphql.query.default:default')) {
      $route->setOptions(['_auth' => ['basic_auth']]);

However, when I make a curl request without an Authorization header it still goes through:

curl -X POST -H "Content-Type: application/json"   --data '{"query":"{fileById(id: \"33\") {changed}}","variables":null,"operationName":null}' http://MYLOCALHOST/graphql



I did enable my custom module with the RouteSubscriber information above and also the Basic Auth module. When I visit the /graphql Drupal path in a browser, access is denied but when I make the CURL request it goes through. I was hoping to restrict CURL access as well.

Here is the Drupal 8 documentation on Basic Auth:


I am using v3 of the Drupal 8 GraphQL module.

1 Answer 1


I got it!

I needed to add

$route->setRequirements(['_user_is_logged_in' => 'TRUE']);

...And then do the curl request with the username and password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.