graphql 8.x-3.4

Security release of GraphQL fixing a CSRF vulnerability and an access bypass in entity label handling, see:

1. GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2023-050
2. GraphQL - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2023-051

We recommend the following additional security measures:

GraphqL clients should always send the HTTP Content-Type header "application/json" on POST requests (except for file uploads) and the additional custom HTTP header "Apollo-Require-Preflight: true", which forces browser to make a non-simple POST request to prevent CSRF.

The CSRF vulnerability can also be mitigated by setting the SameSite attribute on session cookies to Lax (recommended) or Strict. This might not be suitable for sites that need to share the Drupal session cookie in some way with other sites. Set the following in your site's services.yml file:

parameters:
session.storage.options:
# Session cookies are only used for backend admin accounts, so we restrict
# the cookies to be used only from the backend origin. We don't use "Strict"
# because that also removes cookies whenever an admin navigates from an
# email or chat app, which is inconvenient. See
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value
cookie_samesite: Lax