TheGraph node authorization

TheGraph is a decentralized protocol for indexing and querying data from blockchains. It allows for querying data that is difficult to query directly.

Projects with complex smart contracts, such as Uniswap, and NFT initiatives, such as Bored Ape Yacht Club, store data on the Ethereum blockchain, making it challenging to read anything other than basic data directly from the blockchain.

Therefore, in blockchain projects, there is often a need to have their own TheGraph node to serve internal needs, but there is no necessity to be an indexer in TheGraph network. In this case, we can run our own TheGraph node, but there is one problem — by default, TheGraph node does not have an authorization mechanism, and if the TheGraph node is on a private network, then there is no problem, but on a public network, anyone can use our resources.

To protect access to the RPC, you can place nginx in front of TheGraph node and use the following options:

• Restrict access to the RPC through a hard-to-guess URL
• Configure authorization through headers

map $http_authorization $token {
 default 0;
 ~.*(Sup3rPassw0rd)$ 1;
}
…

 # Graph JSON-RPC
 location /graph-secret-path-with-some-hash-nu5oa5wua35htqpc10kf {
     if ($token != 1) {
         return 403;
     }
     auth_basic off;
     proxy_pass http://127.0.0.1:8020;
 }

To connect to a TheGrarh RPC for this nginx configuration, you need to have a header authorization=Sup3rPassw0rd and make an request to address /graph-secret-path-with-some-hash-nu5oa5wua35htqpc10kf