Pain point · Permissions & security · Blocks work
Action handlers have no built-in security layer
1 source thread · first seen 2020-05
Summary
Action handler endpoints are protected only by obscurity, and every team must build its own way to authenticate calls from Hasura.
- Affects
- teams using actions
- Workaround
- Custom rotating keys sent in headers
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“By default, the action handlers have a single security layer - by obscurity”