README.md

* This report was auto-generated by graphql-http

GraphQL over HTTP audit report

• 73 audits in total
• ✅ 37 pass
• ⚠️ 36 warnings (optional)

Passing

1. SHOULD accept application/graphql-response+json and match the content-type
2. MUST accept application/json and match the content-type
3. SHOULD accept */* and use application/json for the content-type
4. MUST use utf-8 encoding when responding
5. MUST accept utf-8 encoding
6. MUST assume utf-8 if encoding is unspecified
7. MUST accept POST requests
8. MAY NOT allow executing mutations on GET requests
9. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
10. MUST accept application/json POST requests
11. MUST require a request body on POST
12. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
13. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
14. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
15. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
16. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
17. SHOULD allow string {query} parameter when accepting application/graphql-response+json
18. MUST allow string {query} parameter when accepting application/json
19. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
20. MUST allow string {operationName} parameter when accepting application/json
21. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
22. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
23. MUST allow map {variables} parameter when accepting application/json
24. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
25. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
26. MUST allow map {extensions} parameter when accepting application/json
27. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
28. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
29. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
30. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
31. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
32. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
33. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
34. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
35. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
36. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
37. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json

Warnings

The server SHOULD support these, but is not required.

1. SHOULD assume application/json content-type when accept is missing
   

Status code 400 is not 200

2. MAY accept application/x-www-form-urlencoded formatted GET requests
   

Status code 400 is not 200

3. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
   

Status code 400 is not 200

4. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
   

Status code 400 is not 200

5. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
   

Status code 400 is not 200

6. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
   

Status code 400 is not 200

7. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
   

Status code 400 is not 200

8. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
   

Status code 200 is not 400

9. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
   

Status code 200 is not 400

10. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

11. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

12. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

13. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

14. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

15. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

16. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

17. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

18. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

19. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
    

Status code 400 is not 200

20. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

21. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

22. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

23. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
    

Status code 400 is not 200

24. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
    

Status code 400 is not 200

25. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

26. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

27. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

28. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
    

Status code 400 is not 200

29. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

30. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

31. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

32. SHOULD use 200 status code on JSON parsing failure when accepting application/json
    

Status code 400 is not 200

33. SHOULD use 200 status code if parameters are invalid when accepting application/json
    

Status code 400 is not 200

34. SHOULD use 200 status code on document parsing failure when accepting application/json
    

Status code 400 is not 200

35. SHOULD use 200 status code on document validation failure when accepting application/json
    

Status code 400 is not 200

36. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
    

Response body is not valid JSON. Got "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>SyntaxError: Unexpected end of JSON input<br> &nbsp; &nbsp;at JSON.parse (&lt;anonymous&gt;)<br> &nbsp; &nbsp;at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)<br> &nbsp; &nbsp;at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18<br> &nbsp; &nbsp;at AsyncResource.runInAsyncScope (node:async_hooks:203:9)<br> &nbsp; &nbsp;at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)<br> &nbsp; &nbsp;at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)<br> &nbsp; &nbsp;at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)<br> &nbsp; &nbsp;at IncomingMessage.emit (node:events:513:28)<br> &nbsp; &nbsp;at endReadableNT (node:internal/streams/rea...