diff --git a/implementations/lighthouse/README.md b/implementations/lighthouse/README.md index 9f5cd32c..122fc936 100644 --- a/implementations/lighthouse/README.md +++ b/implementations/lighthouse/README.md @@ -289,7 +289,7 @@ The server MAY support these, but are truly optional. These are suggestio }, { "type": "->", - "line": 89, + "line": 99, "function": "Illuminate\\Pipeline\\{closure}", "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "class": "Illuminate\\Pipeline\\Pipeline" @@ -538,7 +538,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -769,7 +769,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -1000,7 +1000,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -1231,7 +1231,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -1462,7 +1462,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -1693,7 +1693,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -1924,7 +1924,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -2155,7 +2155,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -2386,7 +2386,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -2617,7 +2617,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -2848,7 +2848,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -3079,7 +3079,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -3310,7 +3310,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -3633,7 +3633,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, @@ -3864,7 +3864,7 @@ The server MAY support these, but are truly optional. These are suggestio "call": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize::handle(instance of Illuminate\\Http\\Request, instance of Closure)" }, { - "line": 89, + "line": 99, "file": "/app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "call": "Illuminate\\Pipeline\\Pipeline::Illuminate\\Pipeline\\{closure}(instance of Illuminate\\Http\\Request)" }, diff --git a/implementations/thegraph/README.md b/implementations/thegraph/README.md index 253fbb8b..f3b2e8dc 100644 --- a/implementations/thegraph/README.md +++ b/implementations/thegraph/README.md @@ -3,888 +3,73 @@

GraphQL over HTTP audit report

Passing

  1. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
  2. -
  3. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
  4. +
  5. 9ABE MAY respond with 4xx status code if content-type is not supplied on POST requests
  6. +
  7. A5BF MAY use 400 status code when request body is missing on POST
  8. +
  9. 423L MAY use 400 status code on missing {query} parameter
  10. +
  11. LKJ0 MAY use 400 status code on object {query} parameter
  12. +
  13. LKJ1 MAY use 400 status code on number {query} parameter
  14. +
  15. LKJ2 MAY use 400 status code on boolean {query} parameter
  16. +
  17. LKJ3 MAY use 400 status code on array {query} parameter
  18. +
  19. 6C00 MAY use 400 status code on object {operationName} parameter
  20. +
  21. 6C01 MAY use 400 status code on number {operationName} parameter
  22. +
  23. 6C02 MAY use 400 status code on boolean {operationName} parameter
  24. +
  25. 6C03 MAY use 400 status code on array {operationName} parameter
  26. +
  27. 4760 MAY use 400 status code on string {variables} parameter
  28. +
  29. 4761 MAY use 400 status code on number {variables} parameter
  30. +
  31. 4762 MAY use 400 status code on boolean {variables} parameter
  32. +
  33. 4763 MAY use 400 status code on array {variables} parameter
  34. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
  35. -
  36. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
  37. -
  38. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
  39. +
  40. 58B0 MAY use 400 status code on string {extensions} parameter
  41. +
  42. 58B1 MAY use 400 status code on number {extensions} parameter
  43. +
  44. 58B2 MAY use 400 status code on boolean {extensions} parameter
  45. +
  46. 58B3 MAY use 400 status code on array {extensions} parameter
  47. +
  48. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
  49. +
  50. BCF8 MAY use 400 status code on JSON parsing failure
  51. +
  52. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
  53. +
  54. 3E3A MAY use 400 status code if parameters are invalid
  55. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
  56. +
  57. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
  58. +
  59. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
  60. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
  61. +
  62. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
  63. +
  64. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
  65. +
  66. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
-

Warnings

-The server SHOULD support these, but is not required. -
    -
  1. 22EB SHOULD accept application/graphql-response+json and match the content-type -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  2. -
  3. 47DE SHOULD accept */* and use application/json for the content-type -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  4. -
  5. 80D8 SHOULD assume application/json content-type when accept is missing -
    -Response header content-type does not contain application/json -
    {
    -  "statusText": "OK",
    -  "status": 200,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "transfer-encoding": "chunked",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/html",
    -    "content-encoding": "br",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": ""
    -}
    -
    -
    -
  6. -
  7. 9C48 MAY NOT allow executing mutations on GET requests -
    -Response status is not between 400 and 499 -
    {
    -  "statusText": "OK",
    -  "status": 200,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "transfer-encoding": "chunked",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/html",
    -    "content-encoding": "br",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": ""
    -}
    -
    -
    -
  8. -
  9. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  10. -
  11. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  12. -
  13. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  14. -
  15. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  16. -
  17. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  18. -
  19. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  20. -
  21. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  22. -
  23. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  24. -
  25. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  26. -
  27. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  28. -
  29. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  30. -
  31. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  32. -
  33. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  34. -
  35. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  36. -
  37. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  38. -
  39. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  40. -
  41. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  42. -
  43. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  44. -
  45. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  46. -
  47. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  48. -
  49. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  50. -
  51. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  52. -
  53. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  54. -
  55. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  56. -
  57. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  58. -
  59. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  60. -
  61. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -
    -Response status code is not 400 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  62. -
  63. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  64. -
  65. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  66. -
  67. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  68. -
  69. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json -
    -Response status code is not 200 -
    {
    -  "statusText": "Not Found",
    -  "status": 404,
    -  "headers": {
    -    "vary": "Accept-Encoding",
    -    "strict-transport-security": "max-age=15724800; includeSubDomains",
    -    "server-timing": "",
    -    "server": "cloudflare",
    -    "date": "",
    -    "content-type": "text/plain",
    -    "content-length": "9",
    -    "connection": "close",
    -    "cf-ray": "",
    -    "cf-cache-status": "DYNAMIC",
    -    "access-control-allow-origin": "*"
    -  },
    -  "body": "Not found"
    -}
    -
    -
    -
  70. -
  71. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json +

    Notices

    +The server MAY support these, but are truly optional. These are suggestions following recommended conventions. +
      +
    1. 9C48 MAY NOT allow executing mutations on GET requests
      -Response status code is not 200 +Response status is not between 400 and 499
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "OK",
      +  "status": 200,
         "headers": {
           "vary": "Accept-Encoding",
      +    "transfer-encoding": "chunked",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "text/html; charset=utf-8",
      +    "content-encoding": "br",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": ""
       }
       
      @@ -899,281 +84,282 @@ The server SHOULD support these, but is not required. "vary": "Accept-Encoding", "transfer-encoding": "chunked", "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", + "set-cookie": "", "server": "cloudflare", "date": "", - "content-type": "text/html", + "content-type": "text/html; charset=utf-8", "content-encoding": "br", "connection": "close", "cf-ray": "", "cf-cache-status": "DYNAMIC", "access-control-allow-origin": "*" }, - "body": null -} - - -
    2. -
    3. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -
      -Response status code is not 400 -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": "Not found"
      +  "body": ""
       }
       
    4. -
    5. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      -Response status code is not 400 +Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    2. -
    3. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json +
    4. 47DE SHOULD accept */* and use application/json for the content-type
      -Response status code is not 400 +Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    5. -
    6. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json +
    7. 80D8 SHOULD assume application/json content-type when accept is missing
      -Response status code is not 400 +Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    8. -
    9. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
    10. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    11. -
    12. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
    13. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    14. -
    15. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
    16. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    17. -
    18. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
    19. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    20. -
    21. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json +
    22. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    23. -
    24. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
    25. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    26. -
    27. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
    28. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1182,22 +368,24 @@ The server SHOULD support these, but is not required.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1206,190 +394,50 @@ The server SHOULD support these, but is not required.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": "Not found"
      -}
      -
      -
      -
    29. -
    30. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -
      -Response status code is not 400 -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": "Not found"
      -}
      -
      -
      -
    31. -
    32. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -
      -Response status code is not 400 -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": "Not found"
      -}
      -
      -
      -
    33. -
    34. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -
      -Response body is not valid JSON -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": null
      -}
      -
      -
      -
    35. -
    36. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -
      -Response status code is not 400 -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": "Not found"
      -}
      -
      -
      -
    37. -
    38. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -
      -Response body is not valid JSON -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": null
      -}
      -
      -
      -
    39. -
    40. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -
      -Response status code is not 400 -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
    41. -
    42. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +
    43. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
      -Response body is not valid JSON +Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": null
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1403,22 +451,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1427,22 +477,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1451,22 +503,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1475,22 +529,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1499,22 +555,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1523,46 +581,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      -  "headers": {
      -    "vary": "Accept-Encoding",
      -    "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      -    "server": "cloudflare",
      -    "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      -    "connection": "close",
      -    "cf-ray": "",
      -    "cf-cache-status": "DYNAMIC",
      -    "access-control-allow-origin": "*"
      -  },
      -  "body": "Not found"
      -}
      -
      -
      -
    44. -
    45. 7267 MUST require a request body on POST -
      -Response status code is not 400 -
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1571,22 +607,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1595,22 +633,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1619,22 +659,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1643,22 +685,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1667,22 +711,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1691,22 +737,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      @@ -1715,22 +763,24 @@ The server MUST support these.
      Response status code is not 200
      {
      -  "statusText": "Not Found",
      -  "status": 404,
      +  "statusText": "Bad Request",
      +  "status": 400,
         "headers": {
           "vary": "Accept-Encoding",
           "strict-transport-security": "max-age=15724800; includeSubDomains",
      -    "server-timing": "",
      +    "set-cookie": "",
           "server": "cloudflare",
           "date": "",
      -    "content-type": "text/plain",
      -    "content-length": "9",
      +    "content-type": "application/json",
      +    "content-length": "101",
           "connection": "close",
           "cf-ray": "",
           "cf-cache-status": "DYNAMIC",
           "access-control-allow-origin": "*"
         },
      -  "body": "Not found"
      +  "body": {
      +    "error": "GraphQL server error (client error): Invalid subgraph name \"sushiswap/exchange/graphql\""
      +  }
       }
       
      diff --git a/implementations/thegraph/report.json b/implementations/thegraph/report.json index 701eaf81..9e6ae4b5 100644 --- a/implementations/thegraph/report.json +++ b/implementations/thegraph/report.json @@ -1,6 +1,7 @@ { - "total": 78, - "ok": 7, - "warn": 57, - "error": 14 + "total": 60, + "ok": 32, + "notice": 2, + "warn": 13, + "error": 13 } diff --git a/src/audits/render.ts b/src/audits/render.ts index 115e5e84..8b2b4fe4 100644 --- a/src/audits/render.ts +++ b/src/audits/render.ts @@ -106,7 +106,7 @@ async function printAuditFail(result: AuditFail) { // some headers change on each run, dont report it if (key === 'date') { headers[key] = ''; - } else if (['cf-ray', 'server-timing'].includes(key)) { + } else if (['cf-ray', 'server-timing', 'set-cookie'].includes(key)) { headers[key] = ''; } else { headers[key] = val; @@ -117,8 +117,12 @@ async function printAuditFail(result: AuditFail) { try { text = await res.text(); json = JSON.parse(text); + // is json, there shouldnt be nothing to sanitize (hopefully) } catch { - // noop + // is not json, avoid rendering html (rest is allowed) + if (res.headers.get('content-type')?.includes('text/html')) { + text = ''; + } } const stringified = JSON.stringify( {