Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrict meilisearch to authenticated users #649

Open
mbellogularte opened this issue Feb 5, 2023 · 3 comments
Open

Restrict meilisearch to authenticated users #649

mbellogularte opened this issue Feb 5, 2023 · 3 comments
Labels
needs investigation Needs to take time to understand the issue.

Comments

@mbellogularte
Copy link

mbellogularte commented Feb 5, 2023

Currently, anyone who is in possession of a public key can query my database. How can I restrict this to authenticated users? Is there an easy way to link the "Authenticated" role i.e.?

@bidoubiwa bidoubiwa added the needs investigation Needs to take time to understand the issue. label Feb 7, 2023
@bidoubiwa
Copy link
Contributor

bidoubiwa commented Feb 7, 2023

Hey @mbellogularte, when you say quering your database, do you mean a query on a strapi route, for example:

POST https://mystrapi.com/meilisearch/content-types

or do you mean on Meilisearch itself:

POST https://my-meili-instance/indexes/restaurant/documents ?

@Kazdan1994
Copy link
Contributor

Hey. No actually you can create a new route in strapi to query your meilisearch database and send the result

@bidoubiwa
Copy link
Contributor

Currently, anyone who is in possession of a public key can query my database

So you mean a Meilisearch public key? The public key gives read rights on the /search route of every index.
You can create keys in Meilisearch with specific rights that can for example limit which index you can query to.

See documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs investigation Needs to take time to understand the issue.
Projects
None yet
Development

No branches or pull requests

3 participants