Skip to content

Commit 050fdfe

Browse files
enisdenjogithub-actions[bot]
enisdenjo
and
github-actions[bot]
authored
fix(handler,audits/server): application/json is the default when accept is missing until watershed (#23)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 2603edf commit 050fdfe

File tree

13 files changed

+651
-636
lines changed

13 files changed

+651
-636
lines changed

‎README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -729,13 +729,13 @@ Having said this, graphql-http is mostly aimed for library authors and simple se
729729

730730
If you want a feature-full server with bleeding edge technologies, you're recommended to use one of the following.
731731

732-
| Name | Audit |
733-
| ------------------------------------------------------------------ | -------------------------------------------------------------------- |
734-
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant (0 warnings)](/implementations/graphql-yoga/README.md) |
735-
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant (0 warnings)](/implementations/hotchocolate/README.md) |
736-
| [postgraphile](https://www.graphile.org/postgraphile/) | [✅ Compliant](/implementations/postgraphile/README.md) |
737-
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md) |
738-
| [mercurius](https://mercurius.dev) | [✅ Compliant](/implementations/mercurius/README.md) |
732+
| Name | Audit |
733+
| ------------------------------------------------------------------ | -------------------------------------------------------- |
734+
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant](/implementations/graphql-yoga/README.md) |
735+
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant](/implementations/hotchocolate/README.md) |
736+
| [postgraphile](https://www.graphile.org/postgraphile/) | [✅ Compliant](/implementations/postgraphile/README.md) |
737+
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md) |
738+
| [mercurius](https://mercurius.dev) | [✅ Compliant](/implementations/mercurius/README.md) |
739739

740740
## [Documentation](docs/)
741741

‎implementations/apollo-server/README.md

+74-77
Large diffs are not rendered by default.

‎implementations/express-graphql/README.md

+73-79
Large diffs are not rendered by default.

‎implementations/graph-client/README.md

+82-72
Original file line numberDiff line numberDiff line change
@@ -3,80 +3,90 @@ _* This report was auto-generated by graphql-http_
33
# GraphQL over HTTP audit report
44

55
- **73** audits in total
6-
- ✅ **73** pass
6+
- ✅ **71** pass
7+
- ⚠️ **2** warnings (optional)
78

89
## Passing
910
1. SHOULD accept application/graphql-response+json and match the content-type
1011
2. MUST accept application/json and match the content-type
11-
3. SHOULD accept \*/\* and use application/graphql-response+json for the content-type
12-
4. SHOULD assume application/graphql-response+json content-type when accept is missing
13-
5. MUST use utf-8 encoding when responding
14-
6. MUST accept utf-8 encoding
15-
7. MUST assume utf-8 if encoding is unspecified
16-
8. MUST accept POST requests
17-
9. MAY accept application/x-www-form-urlencoded formatted GET requests
18-
10. MAY NOT allow executing mutations on GET requests
19-
11. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
20-
12. MUST accept application/json POST requests
21-
13. MUST require a request body on POST
22-
14. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
23-
15. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
24-
16. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
25-
17. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
26-
18. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
27-
19. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
28-
20. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
29-
21. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
30-
22. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
31-
23. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
32-
24. SHOULD allow string {query} parameter when accepting application/graphql-response+json
33-
25. MUST allow string {query} parameter when accepting application/json
34-
26. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
35-
27. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
36-
28. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
37-
29. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
38-
30. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
39-
31. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
40-
32. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
41-
33. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
42-
34. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
43-
35. MUST allow string {operationName} parameter when accepting application/json
44-
36. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
45-
37. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
46-
38. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
47-
39. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
48-
40. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
49-
41. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
50-
42. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
51-
43. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
52-
44. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
53-
45. MUST allow map {variables} parameter when accepting application/json
54-
46. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
55-
47. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
56-
48. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
57-
49. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
58-
50. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
59-
51. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
60-
52. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
61-
53. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
62-
54. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
63-
55. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
64-
56. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
65-
57. MUST allow map {extensions} parameter when accepting application/json
66-
58. SHOULD use 200 status code on JSON parsing failure when accepting application/json
67-
59. SHOULD use 200 status code if parameters are invalid when accepting application/json
68-
60. SHOULD use 200 status code on document parsing failure when accepting application/json
69-
61. SHOULD use 200 status code on document validation failure when accepting application/json
70-
62. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
71-
63. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
72-
64. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
73-
65. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
74-
66. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
75-
67. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
76-
68. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
77-
69. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
78-
70. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
79-
71. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
80-
72. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
81-
73. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
12+
3. MUST use utf-8 encoding when responding
13+
4. MUST accept utf-8 encoding
14+
5. MUST assume utf-8 if encoding is unspecified
15+
6. MUST accept POST requests
16+
7. MAY accept application/x-www-form-urlencoded formatted GET requests
17+
8. MAY NOT allow executing mutations on GET requests
18+
9. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
19+
10. MUST accept application/json POST requests
20+
11. MUST require a request body on POST
21+
12. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
22+
13. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
23+
14. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
24+
15. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
25+
16. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
26+
17. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
27+
18. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
28+
19. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
29+
20. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
30+
21. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
31+
22. SHOULD allow string {query} parameter when accepting application/graphql-response+json
32+
23. MUST allow string {query} parameter when accepting application/json
33+
24. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
34+
25. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
35+
26. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
36+
27. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
37+
28. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
38+
29. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
39+
30. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
40+
31. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
41+
32. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
42+
33. MUST allow string {operationName} parameter when accepting application/json
43+
34. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
44+
35. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
45+
36. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
46+
37. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
47+
38. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
48+
39. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
49+
40. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
50+
41. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
51+
42. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
52+
43. MUST allow map {variables} parameter when accepting application/json
53+
44. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
54+
45. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
55+
46. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
56+
47. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
57+
48. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
58+
49. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
59+
50. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
60+
51. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
61+
52. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
62+
53. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
63+
54. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
64+
55. MUST allow map {extensions} parameter when accepting application/json
65+
56. SHOULD use 200 status code on JSON parsing failure when accepting application/json
66+
57. SHOULD use 200 status code if parameters are invalid when accepting application/json
67+
58. SHOULD use 200 status code on document parsing failure when accepting application/json
68+
59. SHOULD use 200 status code on document validation failure when accepting application/json
69+
60. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
70+
61. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
71+
62. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
72+
63. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
73+
64. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
74+
65. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
75+
66. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
76+
67. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
77+
68. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
78+
69. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
79+
70. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
80+
71. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
81+
82+
## Warnings
83+
The server _SHOULD_ support these, but is not required.
84+
1. SHOULD accept \*/\* and use application/json for the content-type<br />
85+
```
86+
Content-Type header "application/graphql-response+json; charset=utf-8" does not contain "application/json"
87+
```
88+
2. SHOULD assume application/json content-type when accept is missing<br />
89+
```
90+
Content-Type header "application/graphql-response+json; charset=utf-8" does not contain "application/json"
91+
```
8292

0 commit comments

Comments
 (0)