Blog
Hasura GraphQL: CORS configuration, admin secret misuse, and JWT role claims for browsers
Never expose HASURA_GRAPHQL_ADMIN_SECRET in SPAs; use JWT with x-hasura-* claims and tight Allow-Origin lists.
1 min read
hasuragraphqlcors
Subscriptions
WebSocket connections need compatible CORS on the HTTP upgrade path and cookie policies if using credentialed auth.
Throttle subscription fan-out to protect origin servers behind Hasura.
Actions and events
Webhook handlers invoked by Hasura are server-to-server—CORS does not apply, but validate signatures rigorously.
Mirror idempotency keys in event payloads to survive retries without duplicate side effects.