Skip to content

Commit 9c5e8d2

Browse files
enisdenjogithub-actions[bot]
enisdenjo
and
github-actions[bot]
authored
fix(audits/server): A server MAY support GET requests (#18)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent aa29f4c commit 9c5e8d2

File tree

10 files changed

+346
-317
lines changed

10 files changed

+346
-317
lines changed

‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -733,9 +733,9 @@ If you want a feature-full server with bleeding edge technologies, you're recomm
733733
| ------------------------------------------------------------------ | ------------------------------------------------------------------ |
734734
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Fully compliant](/implementations/graphql-yoga/README.md) |
735735
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Fully compliant](/implementations/hotchocolate/README.md) |
736+
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Partially compliant](/implementations/apollo-server/README.md) |
736737
| [mercurius](https://mercurius.dev) | [✅ Partially compliant](/implementations/mercurius/README.md) |
737-
| [graphql-helix](https://www.graphql-helix.com/) | [✅ Partially compliant](/implementations/graphql-helix/README.md) |
738-
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [⚠️ Not compliant](/implementations/apollo-server/README.md) |
738+
| [graphql-helix](https://www.graphql-helix.com/) | [⚠️ Not compliant](/implementations/graphql-helix/README.md) |
739739

740740
## [Documentation](docs/)
741741

‎implementations/apollo-server/README.md

+61-73
Original file line numberDiff line numberDiff line change
@@ -3,61 +3,63 @@ _* This report was auto-generated by graphql-http_
33
# GraphQL over HTTP audit report
44

55
- **73** audits in total
6-
- ✅ **32** pass
7-
- ⚠️ **37** warnings (optional)
8-
- ❌ **4** errors (required)
6+
- ✅ **35** pass
7+
- ⚠️ **38** warnings (optional)
98

109
## Passing
11-
1. MUST accept utf-8 encoding
12-
2. MUST assume utf-8 if encoding is unspecified
13-
3. MUST accept POST requests
14-
4. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
15-
5. MUST accept application/json POST requests
16-
6. MUST require a request body on POST
17-
7. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
18-
8. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
19-
9. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
20-
10. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
21-
11. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
22-
12. SHOULD allow string {query} parameter when accepting application/graphql-response+json
23-
13. MUST allow string {query} parameter when accepting application/json
24-
14. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
25-
15. MUST allow string {operationName} parameter when accepting application/json
26-
16. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
27-
17. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
28-
18. MUST allow map {variables} parameter when accepting application/json
29-
19. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
30-
20. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
31-
21. MUST allow map {extensions} parameter when accepting application/json
32-
22. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
33-
23. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
34-
24. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
35-
25. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
36-
26. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
37-
27. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
38-
28. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
39-
29. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
40-
30. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
41-
31. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
42-
32. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
10+
1. SHOULD accept application/graphql-response+json and match the content-type
11+
2. MUST accept application/json and match the content-type
12+
3. MUST use utf-8 encoding when responding
13+
4. MUST accept utf-8 encoding
14+
5. MUST assume utf-8 if encoding is unspecified
15+
6. MUST accept POST requests
16+
7. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
17+
8. MUST accept application/json POST requests
18+
9. MUST require a request body on POST
19+
10. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
20+
11. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
21+
12. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
22+
13. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
23+
14. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
24+
15. SHOULD allow string {query} parameter when accepting application/graphql-response+json
25+
16. MUST allow string {query} parameter when accepting application/json
26+
17. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
27+
18. MUST allow string {operationName} parameter when accepting application/json
28+
19. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
29+
20. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
30+
21. MUST allow map {variables} parameter when accepting application/json
31+
22. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
32+
23. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
33+
24. MUST allow map {extensions} parameter when accepting application/json
34+
25. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
35+
26. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
36+
27. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
37+
28. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
38+
29. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
39+
30. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
40+
31. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
41+
32. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
42+
33. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
43+
34. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
44+
35. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
4345

4446
## Warnings
4547
The server _SHOULD_ support these, but is not required.
46-
1. SHOULD accept application/graphql-response+json and match the content-type<br />
48+
1. SHOULD accept \*/\* and use application/graphql-response+json for the content-type<br />
4749
```
48-
Status code 400 is not 200
50+
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
4951
```
50-
2. SHOULD accept \*/\* and use application/graphql-response+json for the content-type<br />
52+
2. SHOULD assume application/graphql-response+json content-type when accept is missing<br />
5153
```
52-
Status code 400 is not 200
54+
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
5355
```
54-
3. SHOULD assume application/graphql-response+json content-type when accept is missing<br />
56+
3. MAY accept application/x-www-form-urlencoded formatted GET requests<br />
5557
```
5658
Status code 400 is not 200
5759
```
58-
4. MAY accept application/x-www-form-urlencoded formatted GET requests<br />
60+
4. MAY NOT allow executing mutations on GET requests<br />
5961
```
60-
Status code 400 is not 200
62+
Status code 400 is not 405
6163
```
6264
5. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json<br />
6365
```
@@ -139,74 +141,60 @@ Execution result {"data":{"__typename":"Query"}} does not have a property 'error
139141
```
140142
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
141143
```
142-
25. SHOULD allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json<br />
144+
25. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json<br />
145+
```
146+
Status code 400 is not 200
147+
```
148+
26. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json<br />
143149
```
144150
Status code 400 is not 200
145151
```
146-
26. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json<br />
152+
27. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json<br />
147153
```
148154
Status code 200 is not 400
149155
```
150-
27. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json<br />
156+
28. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json<br />
151157
```
152158
Status code 200 is not 400
153159
```
154-
28. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json<br />
160+
29. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json<br />
155161
```
156162
Status code 200 is not 400
157163
```
158-
29. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json<br />
164+
30. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json<br />
159165
```
160166
Status code 400 is not 200
161167
```
162-
30. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json<br />
168+
31. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json<br />
163169
```
164170
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
165171
```
166-
31. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json<br />
172+
32. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json<br />
167173
```
168174
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
169175
```
170-
32. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json<br />
176+
33. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json<br />
171177
```
172178
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
173179
```
174-
33. SHOULD use 200 status code on JSON parsing failure when accepting application/json<br />
180+
34. SHOULD use 200 status code on JSON parsing failure when accepting application/json<br />
175181
```
176182
Status code 400 is not 200
177183
```
178-
34. SHOULD use 200 status code if parameters are invalid when accepting application/json<br />
184+
35. SHOULD use 200 status code if parameters are invalid when accepting application/json<br />
179185
```
180186
Status code 400 is not 200
181187
```
182-
35. SHOULD use 200 status code on document parsing failure when accepting application/json<br />
188+
36. SHOULD use 200 status code on document parsing failure when accepting application/json<br />
183189
```
184190
Status code 400 is not 200
185191
```
186-
36. SHOULD use 200 status code on document validation failure when accepting application/json<br />
192+
37. SHOULD use 200 status code on document validation failure when accepting application/json<br />
187193
```
188194
Status code 400 is not 200
189195
```
190-
37. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json<br />
196+
38. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json<br />
191197
```
192198
Response body is not valid JSON. Got "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>SyntaxError: Unexpected end of JSON input<br> &nbsp; &nbsp;at JSON.parse (&lt;anonymous&gt;)<br> &nbsp; &nbsp;at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)<br> &nbsp; &nbsp;at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18<br> &nbsp; &nbsp;at AsyncResource.runInAsyncScope (node:async_hooks:203:9)<br> &nbsp; &nbsp;at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)<br> &nbsp; &nbsp;at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)<br> &nbsp; &nbsp;at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)<br> &nbsp; &nbsp;at IncomingMessage.emit (node:events:513:28)<br> &nbsp; &nbsp;at endReadableNT (node:internal/streams/rea...
193199
```
194200

195-
## Errors
196-
The server _MUST_ support these.
197-
1. MUST accept application/json and match the content-type<br />
198-
```
199-
Status code 400 is not 200
200-
```
201-
2. MUST use utf-8 encoding when responding<br />
202-
```
203-
Status code 400 is not 200
204-
```
205-
3. MUST NOT allow executing mutations on GET requests<br />
206-
```
207-
Status code 400 is not 405
208-
```
209-
4. MUST allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json<br />
210-
```
211-
Status code 400 is not 200
212-
```

0 commit comments

Comments
 (0)