Is it possible to disable the '/o/graphql' endpoint?

Issue

• For custom requirements, it may be necessary to disable the /o/graphql endpoint.
• Is there an out-of-the-box configuration to disable this endpoint?

Environment

• Liferay DXP 7.3, DXP 7.4 and Quarterly Releases.

Resolution

There is no out-of-the-box property or configuration to disable the /o/graphql endpoint. However, it can be disabled using one of the following methods:

1. Block the path at the web server level
   • Configure the web server (e.g., Apache, Nginx, ... ) or proxy in front of Liferay to block all requests to the /o/graphql path.

2. Create a servlet filter or any other custom solution

   • Develop and deploy a custom module that implements a servlet filter to intercept and block requests to the endpoint.
   • The filter can be configured to return an HTTP 404 Not Found error, for example:

   ...
   @Component(
       immediate = true,
       property = {
           ...
           "url-pattern=/o/graphql/*"
       },
       service = Filter.class
   )
   public class Sample extends BaseFilter {
   
       @Override
       protected void processFilter(
           HttpServletRequest httpServletRequest,
           HttpServletResponse httpServletResponse, FilterChain filterChain) throws Exception {
   
           httpServletResponse.sendError(404);
       }
       ...
   }

Additional Information

• How to disable API endpoint (/o/api)