Super... thats cool... thanks for sharing. Just today I fixed it in a slightly different (and a lazy way). I introduced a var called COMMERCE in the global vars since the vhost file was referring to the same: # CQ-4287185: Allow access to magento reverse-proxy endpoint SSLProxyEngine on ProxyPass ${COMMERCE_ENDPOINT} ProxyPassReverse ${COMMERCE_ENDPOINT} RewriteEngine Off Could have done it better, but as I said, i guess I am lazy. One question though: Why does it work in author without all th...

Same issue here as well (in 2022 :)) Did you find any solution? This is the summary of my issue The /api/graphql is throwing 403 errors which means no frontend commerce operation is happening on the storefront. I tried adding the /api/graphql to the CSRF filter's exclude list and even removed the POST method from there. After this I still 403 on GET request of /api/graphql and the following on POST request. I am I missing some setting? Note: on the sling servlet resolver config, I have added the...