blocked as a potential Cross-Site Request Forgery (CSRF) about apollo-server HOT 7 CLOSED

import { createWriteStream, unlink } from "fs";
import { ApolloServer } from "@apollo/server";
import { expressMiddleware } from "@apollo/server/express4";
import express from "express";
import pkg from "body-parser";
import cors from "cors";
import mkdirp from "mkdirp";
import shortid from "shortid";
import { schema } from "./schema.js";
import dotenv from "dotenv";
dotenv.config();
const app = express();
const { json } = pkg;

const UPLOAD_DIR = "./uploads";
// Ensure upload directory exists.
mkdirp.sync(UPLOAD_DIR);

/**
 * Stores a GraphQL file upload. The file is stored in the filesystem and its
 * metadata is recorded.
 * @param {GraphQLUpload} upload GraphQL file upload.
 * @returns {object} File metadata.
 */

const storeUpload = async (upload) => {
  console.log("####upload###");
  const { createReadStream, filename, mimetype } = await upload;
  const stream = createReadStream();
  const id = shortid.generate();
  const path = `${UPLOAD_DIR}/${id}-${filename}`;
  const file = { id, filename, mimetype, path };

  await new Promise((resolve, reject) => {
    stream
      .on("error", (error) => {
        unlink(path, () => {
          reject(error);
        });
      })
      .pipe(createWriteStream(path))
      .on("error", reject)
      .on("finish", resolve);
  });
  return file;
};

const server = new ApolloServer({
  csrfPrevention: false,
  schema,
  context: { storeUpload },
});

await server.start();

const PORT = 5031;

app.use("/graphql", cors(), json(), expressMiddleware(server));

app.listen(PORT, () => {
  console.log(`File Server listening on port ${PORT}/graphql`);
});

import { GraphQLList, GraphQLObjectType, GraphQLNonNull } from "graphql";
import GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";
import { FileType } from "./File.js";

export const MutationType = new GraphQLObjectType({
  name: "Mutation",
  fields: () => ({
    singleUpload: {
      description: "Stores a single file.",
      type: new GraphQLNonNull(FileType),
      args: {
        file: {
          description: "File to store.",
          type: new GraphQLNonNull(GraphQLUpload),
        },
      },
      resolve: (parent, { file }, { storeUpload }) => storeUpload(file),
    },
    multipleUpload: {
      description: "Stores multiple files.",
      type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(FileType))),
      args: {
        files: {
          description: "Files to store.",
          type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(GraphQLUpload))),
        },
      },
      async resolve(parent, { files }, { storeUpload }) {
        const uploadedFiles = [];

        for (const file of files) {
          try {
            const uploadedFile = await storeUpload(file);
            uploadedFiles.push(uploadedFile);
          } catch (error) {
            console.error(`${error.name}: ${error.message}`);
          }
        }

        return uploadedFiles;
      },
    },
  }),
});