Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(handler,audits/server): application/json is the default when accept is missing until watershed #23

Merged
merged 4 commits into from
Nov 18, 2022
Merged

fix(handler,audits/server): application/json is the default when accept is missing until watershed #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2e5f95b
application/json is the default until watershed
enisdenjo Nov 18, 2022
300f0a7
docs(implementations): audit report [skip ci]
github-actions[bot] Nov 18, 2022
7c91513
fix tests
enisdenjo Nov 18, 2022
0bef8d1
drop 0 warnings
enisdenjo Nov 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -729,13 +729,13 @@ Having said this, graphql-http is mostly aimed for library authors and simple se

If you want a feature-full server with bleeding edge technologies, you're recommended to use one of the following.

| Name | Audit |
| ------------------------------------------------------------------ | -------------------------------------------------------------------- |
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant (0 warnings)](/implementations/graphql-yoga/README.md) |
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant (0 warnings)](/implementations/hotchocolate/README.md) |
| [postgraphile](https://www.graphile.org/postgraphile/) | [✅ Compliant](/implementations/postgraphile/README.md) |
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md) |
| [mercurius](https://mercurius.dev) | [✅ Compliant](/implementations/mercurius/README.md) |
| Name | Audit |
| ------------------------------------------------------------------ | -------------------------------------------------------- |
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant](/implementations/graphql-yoga/README.md) |
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant](/implementations/hotchocolate/README.md) |
| [postgraphile](https://www.graphile.org/postgraphile/) | [✅ Compliant](/implementations/postgraphile/README.md) |
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md) |
| [mercurius](https://mercurius.dev) | [✅ Compliant](/implementations/mercurius/README.md) |

## [Documentation](docs/)

Expand Down
151 changes: 74 additions & 77 deletions implementations/apollo-server/README.md
View file
Open in desktop

Large diffs are not rendered by default.

152 changes: 73 additions & 79 deletions implementations/express-graphql/README.md
View file
Open in desktop

Large diffs are not rendered by default.

154 changes: 82 additions & 72 deletions implementations/graph-client/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,80 +3,90 @@ _* This report was auto-generated by graphql-http_
# GraphQL over HTTP audit report

- **73** audits in total
- ✅ **73** pass
- ✅ **71** pass
- ⚠️ **2** warnings (optional)

## Passing
1. SHOULD accept application/graphql-response+json and match the content-type
2. MUST accept application/json and match the content-type
3. SHOULD accept \*/\* and use application/graphql-response+json for the content-type
4. SHOULD assume application/graphql-response+json content-type when accept is missing
5. MUST use utf-8 encoding when responding
6. MUST accept utf-8 encoding
7. MUST assume utf-8 if encoding is unspecified
8. MUST accept POST requests
9. MAY accept application/x-www-form-urlencoded formatted GET requests
10. MAY NOT allow executing mutations on GET requests
11. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
12. MUST accept application/json POST requests
13. MUST require a request body on POST
14. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
15. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
16. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
17. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
18. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
19. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
20. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
21. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
22. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
23. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
24. SHOULD allow string {query} parameter when accepting application/graphql-response+json
25. MUST allow string {query} parameter when accepting application/json
26. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
27. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
28. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
29. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
30. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
31. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
32. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
33. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
34. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
35. MUST allow string {operationName} parameter when accepting application/json
36. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
37. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
38. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
39. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
40. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
41. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
42. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
43. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
44. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
45. MUST allow map {variables} parameter when accepting application/json
46. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
47. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
48. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
49. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
50. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
51. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
52. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
53. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
54. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
55. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
56. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
57. MUST allow map {extensions} parameter when accepting application/json
58. SHOULD use 200 status code on JSON parsing failure when accepting application/json
59. SHOULD use 200 status code if parameters are invalid when accepting application/json
60. SHOULD use 200 status code on document parsing failure when accepting application/json
61. SHOULD use 200 status code on document validation failure when accepting application/json
62. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
63. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
64. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
65. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
66. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
67. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
68. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
69. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
70. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
71. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
72. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
73. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
3. MUST use utf-8 encoding when responding
4. MUST accept utf-8 encoding
5. MUST assume utf-8 if encoding is unspecified
6. MUST accept POST requests
7. MAY accept application/x-www-form-urlencoded formatted GET requests
8. MAY NOT allow executing mutations on GET requests
9. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
10. MUST accept application/json POST requests
11. MUST require a request body on POST
12. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
13. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
14. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
15. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
16. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
17. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
18. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
19. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
20. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
21. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
22. SHOULD allow string {query} parameter when accepting application/graphql-response+json
23. MUST allow string {query} parameter when accepting application/json
24. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
25. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
26. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
27. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
28. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
29. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
30. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
31. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
32. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
33. MUST allow string {operationName} parameter when accepting application/json
34. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
35. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
36. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
37. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
38. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
39. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
40. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
41. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
42. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
43. MUST allow map {variables} parameter when accepting application/json
44. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
45. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
46. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
47. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
48. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
49. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
50. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
51. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
52. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
53. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
54. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
55. MUST allow map {extensions} parameter when accepting application/json
56. SHOULD use 200 status code on JSON parsing failure when accepting application/json
57. SHOULD use 200 status code if parameters are invalid when accepting application/json
58. SHOULD use 200 status code on document parsing failure when accepting application/json
59. SHOULD use 200 status code on document validation failure when accepting application/json
60. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
61. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
62. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
63. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
64. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
65. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
66. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
67. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
68. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
69. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
70. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
71. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json

## Warnings
The server _SHOULD_ support these, but is not required.
1. SHOULD accept \*/\* and use application/json for the content-type<br />
```
Content-Type header "application/graphql-response+json; charset=utf-8" does not contain "application/json"
```
2. SHOULD assume application/json content-type when accept is missing<br />
```
Content-Type header "application/graphql-response+json; charset=utf-8" does not contain "application/json"
```

Loading