From 6de8d887199c05e62f602c82f550844fa45871b7 Mon Sep 17 00:00:00 2001 From: enisdenjo Date: Sun, 12 Feb 2023 19:26:18 +0100 Subject: [PATCH 1/6] begin --- src/audits/index.ts | 1 + src/audits/render.ts | 143 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 144 insertions(+) create mode 100644 src/audits/render.ts diff --git a/src/audits/index.ts b/src/audits/index.ts index bbeac2ed..f4bae304 100644 --- a/src/audits/index.ts +++ b/src/audits/index.ts @@ -1,2 +1,3 @@ export * from './common'; export * from './server'; +export * from './render'; diff --git a/src/audits/render.ts b/src/audits/render.ts new file mode 100644 index 00000000..816106b8 --- /dev/null +++ b/src/audits/render.ts @@ -0,0 +1,143 @@ +import { AuditResult, AuditOk, AuditFail } from './common'; + +/** + * Renders the provided audit results to well-formatted and valid HTML. + * + * Do note that the rendered result is not an HTML document, it's rather + * just a component with results. + */ +export async function renderAuditResultsToHTML(results: AuditResult[]) { + const grouped = { + total: 0, + ok: [] as AuditOk[], + warn: [] as AuditFail[], + error: [] as AuditFail[], + }; + for (const result of results) { + grouped.total++; + if (result.status === 'ok') { + grouped[result.status].push(result); + } else { + grouped[result.status].push(result); + } + } + + let report = '* This report was auto-generated by graphql-http\n'; + report += '\n'; + + report += '

GraphQL over HTTP audit report

\n'; + report += '\n'; + + report += '\n'; + report += '\n'; + + if (grouped.ok.length) { + report += '

Passing

\n'; + report += '
    \n'; + for (const [, result] of grouped.ok.entries()) { + report += `
  1. ${result.id} ${result.name}
    2. \n`; + } + report += '
\n'; + report += '\n'; + } + + if (grouped.warn.length) { + report += `

Warnings

\n`; + report += 'The server SHOULD support these, but is not required.\n'; + report += '
    \n'; + for (const [, result] of grouped.warn.entries()) { + report += await printAuditFail(result); + } + report += '
\n'; + report += '\n'; + } + + if (grouped.error.length) { + report += `

Errors

\n`; + report += 'The server MUST support these.\n'; + report += '
    \n'; + for (const [, result] of grouped.error.entries()) { + report += await printAuditFail(result); + } + report += '
\n'; + } + + return report; +} + +async function printAuditFail(result: AuditFail) { + let report = ''; + report += `
  • ${result.id} ${result.name}\n`; + report += '
    \n'; + report += `${truncate(result.reason)}\n`; + report += '
    '; // no "\n" because they count in HTML pre tags
+  const res = result.response;
+  const headers: Record = {};
+  for (const [key, val] of res.headers.entries()) {
+    // some headers change on each run, dont report it
+    if (key === 'date') {
+      headers[key] = '';
+    } else if (['cf-ray', 'server-timing'].includes(key)) {
+      headers[key] = '';
+    } else {
+      headers[key] = val;
+    }
+  }
+  let text = '',
+    json;
+  try {
+    text = await res.text();
+    json = JSON.parse(text);
+  } catch {
+    // noop
+  }
+  const stringified = JSON.stringify(
+    {
+      status: res.status,
+      statusText: res.statusText,
+      headers,
+      body: json || (text?.length > 5120 ? '' : text) || null,
+    },
+    (_k, v) => {
+      if (v != null && typeof v === 'object' && !Array.isArray(v)) {
+        // sort object fields for stable stringify
+        const acc: Record = {};
+        return Object.keys(v)
+          .sort()
+          .reverse() // body on bottom
+          .reduce((acc, k) => {
+            acc[k] = v[k];
+            return acc;
+          }, acc);
+      }
+      return v;
+    },
+    2,
+  );
+  report += stringified + '\n';
+  report += '
    \n'; + report += '
    \n'; + report += '
    • \n'; + + return report; +} + +function truncate(str: string, len = 1024) { + if (str.length > len) { + return str.substring(0, len) + '...'; + } + return str; +} From 6d66cf060ef9af90bf610270e4e00d0453c8f1da Mon Sep 17 00:00:00 2001 From: enisdenjo Date: Sun, 12 Feb 2023 19:26:24 +0100 Subject: [PATCH 2/6] docs --- docs/README.md | 1 + docs/modules/audits_render.md | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 docs/modules/audits_render.md diff --git a/docs/README.md b/docs/README.md index 81400c13..98efa70e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,6 +7,7 @@ graphql-http ### Modules - [audits/common](modules/audits_common.md) +- [audits/render](modules/audits_render.md) - [audits/server](modules/audits_server.md) - [client](modules/client.md) - [common](modules/common.md) diff --git a/docs/modules/audits_render.md b/docs/modules/audits_render.md new file mode 100644 index 00000000..ca168a4c --- /dev/null +++ b/docs/modules/audits_render.md @@ -0,0 +1,30 @@ +[graphql-http](../README.md) / audits/render + +# Module: audits/render + +## Table of contents + +### Functions + +- [renderAuditResultsToHTML](audits_render.md#renderauditresultstohtml) + +## Functions + +### renderAuditResultsToHTML + +▸ **renderAuditResultsToHTML**(`results`): `Promise`<`string`\> + +Renders the provided audit results to well-formatted and valid HTML. + +Do note that the rendered result is not an HTML document, it's rather +just a component with results. + +#### Parameters + +| Name | Type | +| :------ | :------ | +| `results` | [`AuditResult`](audits_common.md#auditresult)[] | + +#### Returns + +`Promise`<`string`\> From c7b40d930060b7776946a595fd82c8cb82b5214a Mon Sep 17 00:00:00 2001 From: enisdenjo Date: Sun, 12 Feb 2023 19:26:27 +0100 Subject: [PATCH 3/6] tests --- package.json | 2 + src/__tests__/audits.ts | 179 +++++++++++++++++++++++++++++++++++++++- yarn.lock | 137 ++++++++++++++++++++++++++++-- 3 files changed, 310 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index 67ab45fa..d428722f 100644 --- a/package.json +++ b/package.json @@ -109,6 +109,7 @@ "@types/eslint": "^8.21.0", "@types/express": "^4.17.17", "@types/glob": "^8.0.1", + "@types/html-validator": "^5.0.3", "@types/jest": "^29.4.0", "@types/koa": "^2.13.5", "@types/koa-mount": "^4.0.2", @@ -121,6 +122,7 @@ "express": "^4.18.2", "fastify": "^4.12.0", "graphql": "^16.6.0", + "html-validator": "^6.0.1", "jest": "^29.4.2", "jest-jasmine2": "^29.4.2", "koa": "^2.14.1", diff --git a/src/__tests__/audits.ts b/src/__tests__/audits.ts index 194f2cc4..9c526598 100644 --- a/src/__tests__/audits.ts +++ b/src/__tests__/audits.ts @@ -1,4 +1,10 @@ -import { Audit, serverAudits } from '../audits'; +import { + Audit, + serverAudits, + AuditResult, + renderAuditResultsToHTML, +} from '../audits'; +import htmlValidator from 'html-validator'; it('should have globally unique audit ids', () => { const ids: string[] = []; @@ -28,3 +34,174 @@ it('should not change globally unique audit ids', () => { // but existing ones SHOULD NOT CHANGE semantically expect(audits).toMatchSnapshot(); }); + +describe('Render audit results to HTML', () => { + const results: AuditResult[] = [ + { + id: 'ok1', + name: 'MUST ok1', + status: 'ok', + }, + { + id: 'ok2', + name: 'MUST ok2', + status: 'ok', + }, + { + id: 'warn1', + name: 'SHOULD warn1', + status: 'warn', + reason: 'bad warn1', + response: new Response('Warning!', { + status: 400, + headers: { 'x-id': 'warn1' }, + }), + }, + { + id: 'warn2', + name: 'SHOULD warn2', + status: 'warn', + reason: 'bad warn2', + response: new Response('Warning!', { + status: 400, + headers: { 'x-id': 'warn2' }, + }), + }, + { + id: 'error1', + name: 'MUST error1', + status: 'error', + reason: 'bad error1', + response: new Response('Error!', { + status: 500, + headers: { 'x-id': 'error1' }, + }), + }, + { + id: 'error2', + name: 'MUST error2', + status: 'error', + reason: 'bad error2', + response: new Response('Error!', { + status: 500, + headers: { 'x-id': 'error2' }, + }), + }, + ]; + + it('should render HTML', async () => { + await expect(renderAuditResultsToHTML(results)).resolves + .toMatchInlineSnapshot(` + "* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 6 audits in total
      • +
    • ✅ 2 pass
      • +
    • ⚠️ 2 warnings (optional)
      • +
    • ❌ 2 errors (required)
      • +
    + +

    Passing

    +
      +
    1. ok1 MUST ok1
      2. +
    2. ok2 MUST ok2
      3. +
    + +

    Warnings

    + The server SHOULD support these, but is not required. +
      +
    1. warn1 SHOULD warn1 +
      + bad warn1 + 
      {
+        "statusText": "",
+        "status": 400,
+        "headers": {
+          "x-id": "warn1",
+          "content-type": "text/plain;charset=UTF-8"
+        },
+        "body": "Warning!"
+      }
+
      +
      +
      2. +
    2. warn2 SHOULD warn2 +
      + bad warn2 + 
      {
+        "statusText": "",
+        "status": 400,
+        "headers": {
+          "x-id": "warn2",
+          "content-type": "text/plain;charset=UTF-8"
+        },
+        "body": "Warning!"
+      }
+
      +
      +
      3. +
    + +

    Errors

    + The server MUST support these. +
      +
    1. error1 MUST error1 +
      + bad error1 + 
      {
+        "statusText": "",
+        "status": 500,
+        "headers": {
+          "x-id": "error1",
+          "content-type": "text/plain;charset=UTF-8"
+        },
+        "body": "Error!"
+      }
+
      +
      +
      2. +
    2. error2 MUST error2 +
      + bad error2 + 
      {
+        "statusText": "",
+        "status": 500,
+        "headers": {
+          "x-id": "error2",
+          "content-type": "text/plain;charset=UTF-8"
+        },
+        "body": "Error!"
+      }
+
      +
      +
      3. +
    + " + `); + }); + + it('should render well-formatted and valid HTML', async () => { + const rendered = await renderAuditResultsToHTML(results); + + const document = ` + + + graphql-http + + ${rendered} + + `; + + await expect( + htmlValidator({ + data: document, + }), + ).resolves.toMatchInlineSnapshot(` + { + "messages": [], + } + `); + }); +}); diff --git a/yarn.lock b/yarn.lock index bb97a1fc..4c369052 100644 --- a/yarn.lock +++ b/yarn.lock @@ -255,7 +255,7 @@ __metadata: languageName: node linkType: hard -"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.12.13, @babel/code-frame@npm:^7.18.6": +"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.10.0, @babel/code-frame@npm:^7.12.13, @babel/code-frame@npm:^7.16.0, @babel/code-frame@npm:^7.18.6": version: 7.18.6 resolution: "@babel/code-frame@npm:7.18.6" dependencies: @@ -2863,6 +2863,16 @@ __metadata: languageName: node linkType: hard +"@html-validate/stylish@npm:^2.0.0": + version: 2.0.1 + resolution: "@html-validate/stylish@npm:2.0.1" + dependencies: + kleur: ^4.0.0 + text-table: ^0.2.0 + checksum: 82974eaba46008ad4029d695bf0a8470d3ed8c22470a627ac8b041e032600063cf0d3e4cd5d456df0624e083cb5ef28f40142f0500a1ef5073e354e3486c2cd0 + languageName: node + linkType: hard + "@humanwhocodes/config-array@npm:^0.11.8": version: 0.11.8 resolution: "@humanwhocodes/config-array@npm:0.11.8" @@ -3905,6 +3915,18 @@ __metadata: languageName: node linkType: hard +"@sidvind/better-ajv-errors@npm:^1.1.1": + version: 1.1.1 + resolution: "@sidvind/better-ajv-errors@npm:1.1.1" + dependencies: + "@babel/code-frame": ^7.16.0 + chalk: ^4.1.0 + peerDependencies: + ajv: 4.11.8 - 8 + checksum: 56f1ef7537465087e5ef5ddd9b67fbe3fdfc7194e43857b9b7ea09caee075f6764280cb03b14fb589913ed958c5f595f10b8e9e613dbf66fc3d1d778a22439ff + languageName: node + linkType: hard + "@sinclair/typebox@npm:^0.25.16": version: 0.25.21 resolution: "@sinclair/typebox@npm:0.25.21" @@ -4112,6 +4134,15 @@ __metadata: languageName: node linkType: hard +"@types/html-validator@npm:^5.0.3": + version: 5.0.3 + resolution: "@types/html-validator@npm:5.0.3" + dependencies: + "@types/node": "*" + checksum: e67b031e8e621f860362f797661e4c55d91f0475c935162571b78067b69b2237ece67e64a6d5768cb7c3ae58d71ade663defc160d062803e669d06bb2252f413 + languageName: node + linkType: hard + "@types/http-assert@npm:*": version: 1.5.3 resolution: "@types/http-assert@npm:1.5.3" @@ -4626,7 +4657,7 @@ __metadata: languageName: node linkType: hard -"acorn-walk@npm:^8.1.1": +"acorn-walk@npm:^8.0.0, acorn-walk@npm:^8.1.1": version: 8.2.0 resolution: "acorn-walk@npm:8.2.0" checksum: 1715e76c01dd7b2d4ca472f9c58968516a4899378a63ad5b6c2d668bba8da21a71976c14ec5f5b75f887b6317c4ae0b897ab141c831d741dc76024d8745f1ad1 @@ -4949,6 +4980,16 @@ __metadata: languageName: node linkType: hard +"axios@npm:0.27.2": + version: 0.27.2 + resolution: "axios@npm:0.27.2" + dependencies: + follow-redirects: ^1.14.9 + form-data: ^4.0.0 + checksum: 38cb7540465fe8c4102850c4368053c21683af85c5fdf0ea619f9628abbcb59415d1e22ebc8a6390d2bbc9b58a9806c874f139767389c862ec9b772235f06854 + languageName: node + linkType: hard + "babel-jest@npm:^29.4.2": version: 29.4.2 resolution: "babel-jest@npm:29.4.2" @@ -6021,7 +6062,7 @@ __metadata: languageName: node linkType: hard -"deepmerge@npm:^4.2.2": +"deepmerge@npm:^4.2.0, deepmerge@npm:^4.2.2": version: 4.3.0 resolution: "deepmerge@npm:4.3.0" checksum: c7980eb5c5be040b371f1df0d566473875cfabed9f672ccc177b81ba8eee5686ce2478de2f1d0076391621cbe729e5eacda397179a59ef0f68901849647db126 @@ -6440,7 +6481,7 @@ __metadata: languageName: node linkType: hard -"espree@npm:^9.4.0": +"espree@npm:^9.0.0, espree@npm:^9.4.0": version: 9.4.1 resolution: "espree@npm:9.4.1" dependencies: @@ -6973,6 +7014,16 @@ __metadata: languageName: node linkType: hard +"follow-redirects@npm:^1.14.9": + version: 1.15.2 + resolution: "follow-redirects@npm:1.15.2" + peerDependenciesMeta: + debug: + optional: true + checksum: faa66059b66358ba65c234c2f2a37fcec029dc22775f35d9ad6abac56003268baf41e55f9ee645957b32c7d9f62baf1f0b906e68267276f54ec4b4c597c2b190 + languageName: node + linkType: hard + "foreach@npm:^2.0.4": version: 2.0.6 resolution: "foreach@npm:2.0.6" @@ -6998,6 +7049,17 @@ __metadata: languageName: node linkType: hard +"form-data@npm:^4.0.0": + version: 4.0.0 + resolution: "form-data@npm:4.0.0" + dependencies: + asynckit: ^0.4.0 + combined-stream: ^1.0.8 + mime-types: ^2.1.12 + checksum: 01135bf8675f9d5c61ff18e2e2932f719ca4de964e3be90ef4c36aacfc7b9cb2fceb5eca0b7e0190e3383fe51c5b37f4cb80b62ca06a99aaabfcfd6ac7c9328c + languageName: node + linkType: hard + "formdata-node@npm:^4.3.1": version: 4.4.1 resolution: "formdata-node@npm:4.4.1" @@ -7204,7 +7266,7 @@ __metadata: languageName: node linkType: hard -"glob@npm:^8.0.1": +"glob@npm:^8.0.0, glob@npm:^8.0.1": version: 8.1.0 resolution: "glob@npm:8.1.0" dependencies: @@ -7307,6 +7369,7 @@ __metadata: "@types/eslint": ^8.21.0 "@types/express": ^4.17.17 "@types/glob": ^8.0.1 + "@types/html-validator": ^5.0.3 "@types/jest": ^29.4.0 "@types/koa": ^2.13.5 "@types/koa-mount": ^4.0.2 @@ -7319,6 +7382,7 @@ __metadata: express: ^4.18.2 fastify: ^4.12.0 graphql: ^16.6.0 + html-validator: ^6.0.1 jest: ^29.4.2 jest-jasmine2: ^29.4.2 koa: ^2.14.1 @@ -7576,6 +7640,51 @@ __metadata: languageName: node linkType: hard +"html-validate@npm:7.0.0": + version: 7.0.0 + resolution: "html-validate@npm:7.0.0" + dependencies: + "@babel/code-frame": ^7.10.0 + "@html-validate/stylish": ^2.0.0 + "@sidvind/better-ajv-errors": ^1.1.1 + acorn-walk: ^8.0.0 + ajv: ^8.0.0 + deepmerge: ^4.2.0 + espree: ^9.0.0 + glob: ^8.0.0 + ignore: ^5.0.0 + kleur: ^4.1.0 + minimist: ^1.2.0 + prompts: ^2.0.0 + semver: ^7.0.0 + peerDependencies: + jest: ^25.1 || ^26 || ^27.1 || ^28 + jest-diff: ^25.1 || ^26 || ^27.1 || ^28 + jest-snapshot: ^25.1 || ^26 || ^27.1 || ^28 + peerDependenciesMeta: + jest: + optional: true + jest-diff: + optional: true + jest-snapshot: + optional: true + bin: + html-validate: bin/html-validate.js + checksum: 80cf7adb5b3795af1fa9ad2ca7fb1cf8d14f70e2c8fe23618861954dab9ff31f343ecb4d329e189616b87682bbce35bb207e458ae7e87376c7ac85219c528bb7 + languageName: node + linkType: hard + +"html-validator@npm:^6.0.1": + version: 6.0.1 + resolution: "html-validator@npm:6.0.1" + dependencies: + axios: 0.27.2 + html-validate: 7.0.0 + valid-url: 1.0.9 + checksum: d3d927cbc45fee80e1a76a2961deb3ed0b48b0264f02c68ebd01247da9b8c03c4c81b79f6e60eb90723ecae76090d758bb792464d7942dd168ea4b082bfa7d6d + languageName: node + linkType: hard + "http-assert@npm:^1.3.0": version: 1.5.0 resolution: "http-assert@npm:1.5.0" @@ -7710,7 +7819,7 @@ __metadata: languageName: node linkType: hard -"ignore@npm:^5.2.0": +"ignore@npm:^5.0.0, ignore@npm:^5.2.0": version: 5.2.4 resolution: "ignore@npm:5.2.4" checksum: 3d4c309c6006e2621659311783eaea7ebcd41fe4ca1d78c91c473157ad6666a57a2df790fe0d07a12300d9aac2888204d7be8d59f9aaf665b1c7fcdb432517ef @@ -8888,6 +8997,13 @@ __metadata: languageName: node linkType: hard +"kleur@npm:^4.0.0, kleur@npm:^4.1.0": + version: 4.1.5 + resolution: "kleur@npm:4.1.5" + checksum: 1dc476e32741acf0b1b5b0627ffd0d722e342c1b0da14de3e8ae97821327ca08f9fb944542fb3c126d90ac5f27f9d804edbe7c585bf7d12ef495d115e0f22c12 + languageName: node + linkType: hard + "koa-compose@npm:^4.1.0": version: 4.1.0 resolution: "koa-compose@npm:4.1.0" @@ -10940,7 +11056,7 @@ __metadata: languageName: node linkType: hard -"prompts@npm:^2.0.1": +"prompts@npm:^2.0.0, prompts@npm:^2.0.1": version: 2.4.2 resolution: "prompts@npm:2.4.2" dependencies: @@ -12896,6 +13012,13 @@ __metadata: languageName: node linkType: hard +"valid-url@npm:1.0.9": + version: 1.0.9 + resolution: "valid-url@npm:1.0.9" + checksum: 3ecb030559404441c2cf104cbabab8770efb0f36d117db03d1081052ef133015a68806148ce954bb4dd0b5c42c14b709a88783c93d66b0916cb67ba771c98702 + languageName: node + linkType: hard + "validate-npm-package-license@npm:^3.0.1, validate-npm-package-license@npm:^3.0.4": version: 3.0.4 resolution: "validate-npm-package-license@npm:3.0.4" From eb4b7916a4a2b9e796bb2912e750018b78e741bc Mon Sep 17 00:00:00 2001 From: enisdenjo Date: Sun, 12 Feb 2023 19:36:47 +0100 Subject: [PATCH 4/6] script uses render to html --- scripts/audit-implementation.mjs | 194 ++++--------------------------- 1 file changed, 24 insertions(+), 170 deletions(-) diff --git a/scripts/audit-implementation.mjs b/scripts/audit-implementation.mjs index 25712355..1c1b0f89 100644 --- a/scripts/audit-implementation.mjs +++ b/scripts/audit-implementation.mjs @@ -2,7 +2,7 @@ * * Tests a running local server for GraphQL over HTTP compliance. * - * Optionally creates reports in Markdown and JSON given to the [reportsDir] argument. + * Optionally creates reports in Markdown (rendered in HTML) and JSON given to the [reportsDir] argument. * * Usage example from root of project: * @@ -19,7 +19,7 @@ import os from 'os'; import fetch from 'node-fetch'; import fs from 'fs/promises'; import path from 'path'; -import { auditServer } from '../lib/index.mjs'; +import { auditServer, renderAuditResultsToHTML } from '../lib/index.mjs'; /** * @typedef { import("../src/audits").AuditResult } AuditResult @@ -36,7 +36,28 @@ async function main() { url: serverUrl.toString(), fetchFn: fetch, }); - const { summary, report, counts } = await createReport(results); + + const counts = { + total: 0, + ok: 0, + warn: 0, + error: 0, + }; + for (const result of results) { + counts.total++; + if (result.status === 'ok') { + counts.ok++; + } + if (result.status === 'warn') { + counts.warn++; + } + if (result.status === 'error') { + counts.error++; + } + } + + const summary = `${counts.ok} audits pass out of ${counts.total} (${counts.warn} warnings, ${counts.error} errors)`; + const report = await renderAuditResultsToHTML(results); console.log(report); @@ -77,170 +98,3 @@ main().catch((err) => { console.error(err); process.exit(1); }); - -/** - * @param {AuditResult[]} results - */ -async function createReport(results) { - /** - * @type {{ total: number, ok: AuditOk[], warn: AuditFail[], error: AuditFail[] }} - */ - const grouped = { - total: 0, - ok: [], - warn: [], - error: [], - }; - for (const result of results) { - grouped.total++; - - // trick for TS - if (result.status === 'ok') { - grouped[result.status].push(result); - } else { - grouped[result.status].push(result); - } - } - - let report = '_* This report was auto-generated by graphql-http_\n'; - report += '\n'; - - report += `# GraphQL over HTTP audit report\n`; - report += '\n'; - - report += `- **${grouped.total}** audits in total\n`; - if (grouped.ok.length) { - report += `- ✅ **${grouped.ok.length}** pass\n`; - } - if (grouped.warn.length) { - report += `- ${'⚠️'} **${grouped.warn.length}** warnings (optional)\n`; - } - if (grouped.error.length) { - report += `- ❌ **${grouped.error.length}** errors (required)\n`; - } - report += `\n`; - - if (grouped.ok.length) { - report += `## Passing\n`; - for (const [i, result] of grouped.ok.entries()) { - report += `${i + 1}. \`${result.id}\` ${escapeMarkdown(result.name)}\n`; - } - report += '\n'; - } - - if (grouped.warn.length) { - report += `## Warnings\n`; - report += `The server _SHOULD_ support these, but is not required.\n\n`; - for (const [i, result] of grouped.warn.entries()) { - report += await printAuditFail(result, i); - } - report += '\n'; - } - - if (grouped.error.length) { - report += `## Errors\n`; - report += `The server _MUST_ support these.\n\n`; - for (const [i, result] of grouped.error.entries()) { - report += await printAuditFail(result, i); - } - } - - return { - summary: `${grouped.ok.length} audits pass out of ${grouped.total} (${grouped.warn.length} warnings, ${grouped.error.length} errors)`, - report, - counts: { - total: grouped.total, - ok: grouped.ok.length, - warn: grouped.warn.length, - error: grouped.error.length, - }, - }; -} - -/** - * @param {AuditFail} result - * @param {number} i - */ -async function printAuditFail(result, i) { - let indent = ' '; - let report = ''; - report += - indent + - `${i + 1}. \`${result.id}\` ${escapeMarkdown(result.name)}
    \n\n`; - indent += indent + ' '; // double the indent for details - report += indent + '
    \n'; - report += indent + `${truncate(result.reason)}\n`; - report += indent + '\n'; - report += indent + '```json\n'; - const res = result.response; - /** @type {Record} */ - const headers = {}; - for (const [key, val] of res.headers.entries()) { - // some headers change on each run, dont report it - if (key === 'date') { - headers[key] = ''; - } else if (['cf-ray', 'server-timing'].includes(key)) { - headers[key] = ''; - } else { - headers[key] = val; - } - } - let text = '', - json; - try { - text = await res.text(); - json = JSON.parse(text); - } catch { - // noop - } - const stringified = JSON.stringify( - { - status: res.status, - statusText: res.statusText, - headers, - body: json || (text?.length > 5120 ? '' : text) || null, - }, - (_k, v) => { - if (v != null && typeof v === 'object' && !Array.isArray(v)) { - // sort object fields for stable stringify - /** @type {Record} */ - const acc = {}; - return Object.keys(v) - .sort() - .reverse() // body on bottom - .reduce((acc, k) => { - acc[k] = v[k]; - return acc; - }, acc); - } - return v; - }, - 2, - ); - // adding indentation to stringify doesnt work, just indent each line - for (const line of stringified.split('\n')) { - report += indent + line + '\n'; - } - report += indent + '```\n'; - report += indent + '
    \n'; - report += indent + '\n'; - return report; -} - -/** - * @param {string} str - */ -function escapeMarkdown(str) { - return str.replace(/\*/g, '\\*'); -} - -/** - * @param {string} str - * @param {number} [len=1024] - */ -function truncate(str, len = 1024) { - if (str.length > len) { - return str.substring(0, len) + '...'; - } - return str; -} From 309bf6f91df238f7f432799ce26518958c95b1e8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 12 Feb 2023 18:38:56 +0000 Subject: [PATCH 5/6] docs(implementations): audit report [skip ci] --- implementations/apollo-server/README.md | 1998 ++++++----- implementations/deno/README.md | 1712 +++++----- implementations/express-graphql/README.md | 1710 +++++----- implementations/graph-client/README.md | 170 +- implementations/graphql-helix/README.md | 1452 ++++---- implementations/graphql-yoga/README.md | 170 +- implementations/hotchocolate/README.md | 269 +- implementations/mercurius/README.md | 1481 ++++----- implementations/pioneer/README.md | 314 +- implementations/postgraphile/README.md | 1682 +++++----- implementations/thegraph/README.md | 3683 ++++++++++----------- 11 files changed, 6946 insertions(+), 7695 deletions(-) diff --git a/implementations/apollo-server/README.md b/implementations/apollo-server/README.md index 4910f8e8..a841e8e2 100644 --- a/implementations/apollo-server/README.md +++ b/implementations/apollo-server/README.md @@ -1,1111 +1,1041 @@ -_* This report was auto-generated by graphql-http_ +* This report was auto-generated by graphql-http -# GraphQL over HTTP audit report +

    GraphQL over HTTP audit report

    -- **78** audits in total -- ✅ **53** pass -- ⚠️ **25** warnings (optional) +
      +
    • 78 audits in total
      • +
    • ✅ 53 pass
      • +
    • ⚠️ 25 warnings (optional)
      • +
    -## Passing -1. `22EB` SHOULD accept application/graphql-response+json and match the content-type -2. `4655` MUST accept application/json and match the content-type -3. `47DE` SHOULD accept \*/\* and use application/json for the content-type -4. `82A3` MUST use utf-8 encoding when responding -5. `BF61` MUST accept utf-8 encoded request -6. `78D5` MUST assume utf-8 in request if encoding is unspecified -7. `2C94` MUST accept POST requests -8. `9C48` MAY NOT allow executing mutations on GET requests -9. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -10. `03D4` MUST accept application/json POST requests -11. `7267` MUST require a request body on POST -12. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -13. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -14. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -15. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -16. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -17. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -18. `13EE` MUST allow string {query} parameter when accepting application/json -19. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -20. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -21. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -22. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -23. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -24. `B8B3` MUST allow string {operationName} parameter when accepting application/json -25. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -26. `0220` MUST allow null {variables} parameter when accepting application/json -27. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -28. `0221` MUST allow null {operationName} parameter when accepting application/json -29. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -30. `0222` MUST allow null {extensions} parameter when accepting application/json -31. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -32. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -33. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -34. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -35. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -36. `28B9` MUST allow map {variables} parameter when accepting application/json -37. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -38. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json -39. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json -40. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json -41. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -42. `1B7A` MUST allow map {extensions} parameter when accepting application/json -43. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -44. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -45. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -46. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -47. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -48. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -49. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -50. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -51. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -52. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -53. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +

    Passing

    +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 4655 MUST accept application/json and match the content-type
      3. +
    3. 47DE SHOULD accept */* and use application/json for the content-type
      4. +
    4. 82A3 MUST use utf-8 encoding when responding
      5. +
    5. BF61 MUST accept utf-8 encoded request
      6. +
    6. 78D5 MUST assume utf-8 in request if encoding is unspecified
      7. +
    7. 2C94 MUST accept POST requests
      8. +
    8. 9C48 MAY NOT allow executing mutations on GET requests
      9. +
    9. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      10. +
    10. 03D4 MUST accept application/json POST requests
      11. +
    11. 7267 MUST require a request body on POST
      12. +
    12. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      13. +
    13. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      14. +
    14. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      15. +
    15. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      16. +
    16. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      17. +
    17. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      18. +
    18. 13EE MUST allow string {query} parameter when accepting application/json
      19. +
    19. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      20. +
    20. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      21. +
    21. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      22. +
    22. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      23. +
    23. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      24. +
    24. B8B3 MUST allow string {operationName} parameter when accepting application/json
      25. +
    25. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      26. +
    26. 0220 MUST allow null {variables} parameter when accepting application/json
      27. +
    27. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      28. +
    28. 0221 MUST allow null {operationName} parameter when accepting application/json
      29. +
    29. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      30. +
    30. 0222 MUST allow null {extensions} parameter when accepting application/json
      31. +
    31. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      32. +
    32. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      33. +
    33. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      34. +
    34. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      35. +
    35. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      36. +
    36. 28B9 MUST allow map {variables} parameter when accepting application/json
      37. +
    37. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      38. +
    38. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      39. +
    39. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      40. +
    40. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      41. +
    41. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      42. +
    42. 1B7A MUST allow map {extensions} parameter when accepting application/json
      43. +
    43. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      44. +
    44. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      45. +
    45. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      46. +
    46. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      47. +
    47. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      48. +
    48. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      49. +
    49. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      50. +
    50. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      51. +
    51. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      52. +
    52. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      53. +
    53. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      54. +
    -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `80D8` SHOULD assume application/json content-type when accept is missing
    - -
    - Response status code is not 200 - - ```json +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 80D8 SHOULD assume application/json content-type when accept is missing +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1461",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1461",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
-                  "",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
+            "",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 2. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      2. +
    2. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1461",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1461",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
-                  "",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
+            "",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 3. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      3. +
    3. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1416",
+    "connection": "close",
+    "cache-control": "no-store",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1416",
-          "connection": "close",
-          "cache-control": "no-store",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
-                  "    at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
-                  "    at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
-                  "    at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)",
-                  "    at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
+            "    at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
+            "    at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
+            "    at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)",
+            "    at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 4. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      4. +
    4. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"478-8ij0f1w1MThNqXuYJcCeFgzpLvg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1144",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"478-8ij0f1w1MThNqXuYJcCeFgzpLvg\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1144",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "GraphQL queries must be strings.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: GraphQL queries must be strings.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at ensureQueryIsStringOrMissing (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:67:15)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:77:13)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "GraphQL queries must be strings.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: GraphQL queries must be strings.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at ensureQueryIsStringOrMissing (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:67:15)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:77:13)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 5. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      5. +
    5. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1416",
+    "connection": "close",
+    "cache-control": "no-store",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1416",
-          "connection": "close",
-          "cache-control": "no-store",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
-                  "    at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
-                  "    at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
-                  "    at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)",
-                  "    at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
+            "    at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
+            "    at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
+            "    at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)",
+            "    at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 6. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      6. +
    6. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1416",
+    "connection": "close",
+    "cache-control": "no-store",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1416",
-          "connection": "close",
-          "cache-control": "no-store",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
-                  "    at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
-                  "    at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
-                  "    at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)",
-                  "    at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
+            "    at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
+            "    at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
+            "    at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)",
+            "    at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 7. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      7. +
    7. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"478-8ij0f1w1MThNqXuYJcCeFgzpLvg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1144",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"478-8ij0f1w1MThNqXuYJcCeFgzpLvg\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1144",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "GraphQL queries must be strings.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: GraphQL queries must be strings.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at ensureQueryIsStringOrMissing (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:67:15)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:77:13)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "GraphQL queries must be strings.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: GraphQL queries must be strings.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at ensureQueryIsStringOrMissing (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:67:15)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:77:13)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 8. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      8. +
    8. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1050",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1050",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`operationName` in a POST body must be a string if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `operationName` in a POST body must be a string if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`operationName` in a POST body must be a string if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `operationName` in a POST body must be a string if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 9. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      9. +
    9. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1050",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1050",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`operationName` in a POST body must be a string if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `operationName` in a POST body must be a string if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`operationName` in a POST body must be a string if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `operationName` in a POST body must be a string if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 10. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      10. +
    10. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1050",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1050",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`operationName` in a POST body must be a string if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `operationName` in a POST body must be a string if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`operationName` in a POST body must be a string if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `operationName` in a POST body must be a string if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 11. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      11. +
    11. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1050",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"41a-nyphxrE/ooK9c9ewfugL9Rqrh2Y\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1050",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`operationName` in a POST body must be a string if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `operationName` in a POST body must be a string if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`operationName` in a POST body must be a string if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `operationName` in a POST body must be a string if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:97:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 12. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      12. +
    12. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"466-OpPmHAsn4oM5zvBonndNbzxWo1s\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1126",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"466-OpPmHAsn4oM5zvBonndNbzxWo1s\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1126",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`variables` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `variables` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:79:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`variables` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `variables` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:79:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 13. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      13. +
    13. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"414-E6rr7b7CJtPuHGippFX8oDrojxw\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1044",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"414-E6rr7b7CJtPuHGippFX8oDrojxw\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1044",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`variables` in a POST body must be an object if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `variables` in a POST body must be an object if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:92:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`variables` in a POST body must be an object if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `variables` in a POST body must be an object if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:92:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 14. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      14. +
    14. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"414-E6rr7b7CJtPuHGippFX8oDrojxw\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1044",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"414-E6rr7b7CJtPuHGippFX8oDrojxw\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1044",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`variables` in a POST body must be an object if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `variables` in a POST body must be an object if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:92:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`variables` in a POST body must be an object if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `variables` in a POST body must be an object if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:92:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 15. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      15. +
    15. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"414-E6rr7b7CJtPuHGippFX8oDrojxw\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1044",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"414-E6rr7b7CJtPuHGippFX8oDrojxw\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1044",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`variables` in a POST body must be an object if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `variables` in a POST body must be an object if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:92:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`variables` in a POST body must be an object if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `variables` in a POST body must be an object if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:92:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 16. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      16. +
    16. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
+    "date": "",
+    "content-type": "application/graphql-response+json; charset=utf-8",
+    "content-length": "1461",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
-          "date": "",
-          "content-type": "application/graphql-response+json; charset=utf-8",
-          "content-length": "1461",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
-                  "",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
+            "",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 17. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      17. +
    17. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1461",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"5b5-gDRXf8j0lbjWbmQpeY60iENT2cI\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1461",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
-                  "",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight",
+            "",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at preventCsrf (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/preventCsrf.js:29:11)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:478:17)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 18. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      18. +
    18. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"468-TPRc6cNxt9MLpN3l67KK+40WYlI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1128",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"468-TPRc6cNxt9MLpN3l67KK+40WYlI\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1128",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`extensions` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `extensions` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:82:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`extensions` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `extensions` in a POST body should be provided as an object, not a recursively JSON-encoded string.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:82:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 19. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      19. +
    19. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"416-3vSw59SW7xtE8bbw+NTHlFLLef4\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1046",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"416-3vSw59SW7xtE8bbw+NTHlFLLef4\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1046",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`extensions` in a POST body must be an object if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `extensions` in a POST body must be an object if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:87:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`extensions` in a POST body must be an object if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `extensions` in a POST body must be an object if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:87:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 20. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      20. +
    20. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"416-3vSw59SW7xtE8bbw+NTHlFLLef4\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1046",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"416-3vSw59SW7xtE8bbw+NTHlFLLef4\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1046",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`extensions` in a POST body must be an object if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `extensions` in a POST body must be an object if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:87:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`extensions` in a POST body must be an object if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `extensions` in a POST body must be an object if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:87:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 21. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      21. +
    21. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"416-3vSw59SW7xtE8bbw+NTHlFLLef4\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1046",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"416-3vSw59SW7xtE8bbw+NTHlFLLef4\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1046",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "`extensions` in a POST body must be an object if provided.",
-              "extensions": {
-                "stacktrace": [
-                  "BadRequestError: `extensions` in a POST body must be an object if provided.",
-                  "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
-                  "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
-                  "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:87:23)",
-                  "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
-                  "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
-                  "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
-                ],
-                "code": "BAD_REQUEST"
-              }
-            }
-          ]
+        "message": "`extensions` in a POST body must be an object if provided.",
+        "extensions": {
+          "stacktrace": [
+            "BadRequestError: `extensions` in a POST body must be an object if provided.",
+            "    at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)",
+            "    at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)",
+            "    at runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:87:23)",
+            "    at runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:22)",
+            "    at ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:26)",
+            "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
+          ],
+          "code": "BAD_REQUEST"
         }
       }
-      ```
-
      - - 22. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      22. +
    22. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "x-content-type-options": "nosniff",
+    "date": "",
+    "content-type": "text/html; charset=utf-8",
+    "content-security-policy": "default-src 'none'",
+    "content-length": "1108",
+    "connection": "close",
+    "access-control-allow-origin": "*"
+  },
+  "body": "\n\n\n\nError\n\n\n
      SyntaxError: Unexpected end of JSON input
          at JSON.parse (<anonymous>)
          at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)
          at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18
          at AsyncResource.runInAsyncScope (node:async_hooks:204:9)
          at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)
          at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)
          at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)
          at IncomingMessage.emit (node:events:513:28)
          at endReadableNT (node:internal/streams/readable:1359:12)
          at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
      \n\n\n"
+}
+
      +
      +
      23. +
    23. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1416",
+    "connection": "close",
+    "cache-control": "no-store",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "x-content-type-options": "nosniff",
-          "date": "",
-          "content-type": "text/html; charset=utf-8",
-          "content-security-policy": "default-src 'none'",
-          "content-length": "1108",
-          "connection": "close",
-          "access-control-allow-origin": "*"
-        },
-        "body": "\n\n\n\nError\n\n\n
      SyntaxError: Unexpected end of JSON input
          at JSON.parse (<anonymous>)
          at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)
          at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18
          at AsyncResource.runInAsyncScope (node:async_hooks:204:9)
          at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)
          at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)
          at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)
          at IncomingMessage.emit (node:events:513:28)
          at endReadableNT (node:internal/streams/readable:1359:12)
          at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
      \n\n\n"
-      }
-      ```
-
      - - 23. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"588-sZ+sg/c+DRv3ORN3VlSdMHvZRkc\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "1416", - "connection": "close", - "cache-control": "no-store", - "access-control-allow-origin": "*" - }, - "body": { - "errors": [ - { - "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.", - "extensions": { - "stacktrace": [ - "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.", - " at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)", - " at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)", - " at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)", - " at process.processTicksAndRejections (node:internal/process/task_queues:95:5)", - " at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)", - " at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)", - " at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)", - " at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)" - ], - "code": "BAD_REQUEST" - } - } - ] + "message": "GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.", + "extensions": { + "stacktrace": [ + "BadRequestError: GraphQL operations must contain a non-empty `query` or a `persistedQuery` extension.", + " at new GraphQLErrorWithCode (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:7:9)", + " at new BadRequestError (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/internalErrorClasses.js:75:9)", + " at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:68:13)", + " at process.processTicksAndRejections (node:internal/process/task_queues:95:5)", + " at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)", + " at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)", + " at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)", + " at async ApolloServer.executeHTTPGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:496:20)" + ], + "code": "BAD_REQUEST" } } - ``` -
      - - 24. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      24. +
    24. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"59f-wZcL/SqdL2p72c+22U9112bt9Sk\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1439",
+    "connection": "close",
+    "cache-control": "no-store",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"59f-wZcL/SqdL2p72c+22U9112bt9Sk\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1439",
-          "connection": "close",
-          "cache-control": "no-store",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Syntax Error: Expected Name, found .",
-              "locations": [
-                {
-                  "line": 1,
-                  "column": 2
-                }
-              ],
-              "extensions": {
-                "stacktrace": [
-                  "GraphQLError: Syntax Error: Expected Name, found .",
-                  "    at syntaxError (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/error/syntaxError.js:15:10)",
-                  "    at Parser.expectToken (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1397:40)",
-                  "    at Parser.parseName (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:108:24)",
-                  "    at Parser.parseField (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:347:30)",
-                  "    at Parser.parseSelection (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:337:14)",
-                  "    at Parser.many (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1511:26)",
-                  "    at Parser.parseSelectionSet (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:320:24)",
-                  "    at Parser.parseOperationDefinition (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:231:28)",
-                  "    at Parser.parseDefinition (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:155:19)",
-                  "    at Parser.many (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1511:26)"
-                ],
-                "code": "GRAPHQL_PARSE_FAILED"
-              }
-            }
-          ]
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
+          }
+        ],
+        "extensions": {
+          "stacktrace": [
+            "GraphQLError: Syntax Error: Expected Name, found .",
+            "    at syntaxError (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/error/syntaxError.js:15:10)",
+            "    at Parser.expectToken (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1397:40)",
+            "    at Parser.parseName (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:108:24)",
+            "    at Parser.parseField (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:347:30)",
+            "    at Parser.parseSelection (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:337:14)",
+            "    at Parser.many (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1511:26)",
+            "    at Parser.parseSelectionSet (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:320:24)",
+            "    at Parser.parseOperationDefinition (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:231:28)",
+            "    at Parser.parseDefinition (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:155:19)",
+            "    at Parser.many (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1511:26)"
+          ],
+          "code": "GRAPHQL_PARSE_FAILED"
         }
       }
-      ```
-
      - - 25. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      25. +
    25. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"5ae-cH8StyqXwjsvF8Ml3ZMaXdrpW14\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "1454",
+    "connection": "close",
+    "cache-control": "no-store",
+    "access-control-allow-origin": "*"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "etag": "W/\"5ae-cH8StyqXwjsvF8Ml3ZMaXdrpW14\"",
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "1454",
-          "connection": "close",
-          "cache-control": "no-store",
-          "access-control-allow-origin": "*"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
-              "locations": [
-                {
-                  "line": 1,
-                  "column": 4
-                }
-              ],
-              "extensions": {
-                "stacktrace": [
-                  "GraphQLError: Syntax Error: Invalid number, expected digit but got: \"f\".",
-                  "    at syntaxError (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/error/syntaxError.js:15:10)",
-                  "    at readNumber (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:550:40)",
-                  "    at readNextToken (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:413:14)",
-                  "    at Lexer.lookahead (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:84:29)",
-                  "    at Lexer.advance (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:67:38)",
-                  "    at Parser.advanceLexer (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1536:31)",
-                  "    at Parser.expectToken (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1393:12)",
-                  "    at Parser.many (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1507:10)",
-                  "    at Parser.parseSelectionSet (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:320:24)",
-                  "    at Parser.parseOperationDefinition (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:231:28)"
-                ],
-                "code": "GRAPHQL_PARSE_FAILED"
-              }
-            }
-          ]
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
+          }
+        ],
+        "extensions": {
+          "stacktrace": [
+            "GraphQLError: Syntax Error: Invalid number, expected digit but got: \"f\".",
+            "    at syntaxError (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/error/syntaxError.js:15:10)",
+            "    at readNumber (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:550:40)",
+            "    at readNextToken (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:413:14)",
+            "    at Lexer.lookahead (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:84:29)",
+            "    at Lexer.advance (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/lexer.js:67:38)",
+            "    at Parser.advanceLexer (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1536:31)",
+            "    at Parser.expectToken (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1393:12)",
+            "    at Parser.many (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:1507:10)",
+            "    at Parser.parseSelectionSet (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:320:24)",
+            "    at Parser.parseOperationDefinition (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/parser.js:231:28)"
+          ],
+          "code": "GRAPHQL_PARSE_FAILED"
         }
       }
-      ```
-
      - + ] + } +} + +
    + + diff --git a/implementations/deno/README.md b/implementations/deno/README.md index 85ff9eff..7b4e9b42 100644 --- a/implementations/deno/README.md +++ b/implementations/deno/README.md @@ -1,919 +1,795 @@ -_* This report was auto-generated by graphql-http_ - -# GraphQL over HTTP audit report - -- **78** audits in total -- ✅ **35** pass -- ⚠️ **43** warnings (optional) - -## Passing -1. `4655` MUST accept application/json and match the content-type -2. `47DE` SHOULD accept \*/\* and use application/json for the content-type -3. `80D8` SHOULD assume application/json content-type when accept is missing -4. `82A3` MUST use utf-8 encoding when responding -5. `BF61` MUST accept utf-8 encoded request -6. `78D5` MUST assume utf-8 in request if encoding is unspecified -7. `2C94` MUST accept POST requests -8. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -9. `9C48` MAY NOT allow executing mutations on GET requests -10. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -11. `03D4` MUST accept application/json POST requests -12. `7267` MUST require a request body on POST -13. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json -14. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json -15. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -16. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -17. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json -18. `13EE` MUST allow string {query} parameter when accepting application/json -19. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json -20. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -21. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -22. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json -23. `B8B3` MUST allow string {operationName} parameter when accepting application/json -24. `0220` MUST allow null {variables} parameter when accepting application/json -25. `0221` MUST allow null {operationName} parameter when accepting application/json -26. `0222` MUST allow null {extensions} parameter when accepting application/json -27. `28B9` MUST allow map {variables} parameter when accepting application/json -28. `1B7A` MUST allow map {extensions} parameter when accepting application/json -29. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json -30. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json -31. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json -32. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -33. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -34. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -35. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json - -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `22EB` SHOULD accept application/graphql-response+json and match the content-type
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 2. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 3. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 4. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 5. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 6. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 7. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 8. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 9. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 10. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 11. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 12. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 13. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 14. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 15. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 16. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 17. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 18. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 19. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 20. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "42", - "content-encoding": "gzip" - }, - "body": "Malformed Request Body" - } - ``` -
    - - 21. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "42", - "content-encoding": "gzip" - }, - "body": "Malformed Request Body" - } - ``` -
    - - 22. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "42", - "content-encoding": "gzip" - }, - "body": "Malformed Request Body" - } - ``` -
    - - 23. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "application/json", - "content-length": "59", - "content-encoding": "gzip" - }, - "body": null - } - ``` -
    - - 24. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 25. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 26. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
    - -
    - Response body execution result has a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "application/json", - "content-length": "163", - "content-encoding": "gzip" - }, - "body": null - } - ``` -
    - - 27. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 28. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 29. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 30. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 31. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "application/json", - "content-length": "59", - "content-encoding": "gzip" - }, - "body": null - } - ``` -
    - - 32. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "application/json", - "content-length": "59", - "content-encoding": "gzip" - }, - "body": null - } - ``` -
    - - 33. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "application/json", - "content-length": "59", - "content-encoding": "gzip" - }, - "body": null - } - ``` -
    - - 34. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "application/json", - "content-length": "59", - "content-encoding": "gzip" - }, - "body": null - } - ``` -
    - - 35. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 36. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "42", - "content-encoding": "gzip" - }, - "body": "Malformed Request Body" - } - ``` -
    - - 37. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 38. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 39. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": null - } - ``` -
    - - 40. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 41. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": null - } - ``` -
    - - 42. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": "Not Acceptable" - } - ``` -
    - - 43. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "Not Acceptable", - "status": 406, - "headers": { - "vary": "Accept-Encoding", - "date": "", - "content-type": "text/plain;charset=UTF-8", - "content-length": "14" - }, - "body": null - } - ``` -
    - +* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 78 audits in total
      • +
    • ✅ 35 pass
      • +
    • ⚠️ 43 warnings (optional)
      • +
    + +

    Passing

    +
      +
    1. 4655 MUST accept application/json and match the content-type
      2. +
    2. 47DE SHOULD accept */* and use application/json for the content-type
      3. +
    3. 80D8 SHOULD assume application/json content-type when accept is missing
      4. +
    4. 82A3 MUST use utf-8 encoding when responding
      5. +
    5. BF61 MUST accept utf-8 encoded request
      6. +
    6. 78D5 MUST assume utf-8 in request if encoding is unspecified
      7. +
    7. 2C94 MUST accept POST requests
      8. +
    8. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      9. +
    9. 9C48 MAY NOT allow executing mutations on GET requests
      10. +
    10. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      11. +
    11. 03D4 MUST accept application/json POST requests
      12. +
    12. 7267 MUST require a request body on POST
      13. +
    13. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
      14. +
    14. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
      15. +
    15. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      16. +
    16. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      17. +
    17. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
      18. +
    18. 13EE MUST allow string {query} parameter when accepting application/json
      19. +
    19. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      20. +
    20. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      21. +
    21. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      22. +
    22. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      23. +
    23. B8B3 MUST allow string {operationName} parameter when accepting application/json
      24. +
    24. 0220 MUST allow null {variables} parameter when accepting application/json
      25. +
    25. 0221 MUST allow null {operationName} parameter when accepting application/json
      26. +
    26. 0222 MUST allow null {extensions} parameter when accepting application/json
      27. +
    27. 28B9 MUST allow map {variables} parameter when accepting application/json
      28. +
    28. 1B7A MUST allow map {extensions} parameter when accepting application/json
      29. +
    29. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json
      30. +
    30. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      31. +
    31. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      32. +
    32. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      33. +
    33. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      34. +
    34. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      35. +
    35. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      36. +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      2. +
    2. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      3. +
    3. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      4. +
    4. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      5. +
    5. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      6. +
    6. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      7. +
    7. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      8. +
    8. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      9. +
    9. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      10. +
    10. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      11. +
    11. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      12. +
    12. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      13. +
    13. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      14. +
    14. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      15. +
    15. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      16. +
    16. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      17. +
    17. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      18. +
    18. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      19. +
    19. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      20. +
    20. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "42",
+    "content-encoding": "gzip"
+  },
+  "body": "Malformed Request Body"
+}
+
      +
      +
      21. +
    21. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "42",
+    "content-encoding": "gzip"
+  },
+  "body": "Malformed Request Body"
+}
+
      +
      +
      22. +
    22. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "42",
+    "content-encoding": "gzip"
+  },
+  "body": "Malformed Request Body"
+}
+
      +
      +
      23. +
    23. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": null
+}
+
      +
      +
      24. +
    24. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      25. +
    25. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      26. +
    26. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json +
      +Response body execution result has a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "163",
+    "content-encoding": "gzip"
+  },
+  "body": null
+}
+
      +
      +
      27. +
    27. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      28. +
    28. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      29. +
    29. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      30. +
    30. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      31. +
    31. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": null
+}
+
      +
      +
      32. +
    32. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": null
+}
+
      +
      +
      33. +
    33. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": null
+}
+
      +
      +
      34. +
    34. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": null
+}
+
      +
      +
      35. +
    35. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      36. +
    36. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "42",
+    "content-encoding": "gzip"
+  },
+  "body": "Malformed Request Body"
+}
+
      +
      +
      37. +
    37. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      38. +
    38. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      39. +
    39. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json +
      +Response body is not valid JSON +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": null
+}
+
      +
      +
      40. +
    40. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      41. +
    41. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json +
      +Response body is not valid JSON +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": null
+}
+
      +
      +
      42. +
    42. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": "Not Acceptable"
+}
+
      +
      +
      43. +
    43. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +
      +Response body is not valid JSON +
      {
+  "statusText": "Not Acceptable",
+  "status": 406,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
+  },
+  "body": null
+}
+
      +
      +
      44. +
    diff --git a/implementations/express-graphql/README.md b/implementations/express-graphql/README.md index 20c8591c..c2318705 100644 --- a/implementations/express-graphql/README.md +++ b/implementations/express-graphql/README.md @@ -1,905 +1,811 @@ -_* This report was auto-generated by graphql-http_ - -# GraphQL over HTTP audit report - -- **78** audits in total -- ✅ **45** pass -- ⚠️ **33** warnings (optional) - -## Passing -1. `4655` MUST accept application/json and match the content-type -2. `47DE` SHOULD accept \*/\* and use application/json for the content-type -3. `80D8` SHOULD assume application/json content-type when accept is missing -4. `82A3` MUST use utf-8 encoding when responding -5. `BF61` MUST accept utf-8 encoded request -6. `78D5` MUST assume utf-8 in request if encoding is unspecified -7. `2C94` MUST accept POST requests -8. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -9. `9C48` MAY NOT allow executing mutations on GET requests -10. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -11. `03D4` MUST accept application/json POST requests -12. `7267` MUST require a request body on POST -13. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -14. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -15. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -16. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -17. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -18. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -19. `13EE` MUST allow string {query} parameter when accepting application/json -20. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -21. `B8B3` MUST allow string {operationName} parameter when accepting application/json -22. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -23. `0220` MUST allow null {variables} parameter when accepting application/json -24. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -25. `0221` MUST allow null {operationName} parameter when accepting application/json -26. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -27. `0222` MUST allow null {extensions} parameter when accepting application/json -28. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -29. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -30. `28B9` MUST allow map {variables} parameter when accepting application/json -31. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -32. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -33. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -34. `1B7A` MUST allow map {extensions} parameter when accepting application/json -35. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -36. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -37. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -38. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -39. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -40. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -41. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -42. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -43. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -44. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -45. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json - -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `22EB` SHOULD accept application/graphql-response+json and match the content-type
    - -
    - Response header content-type does not contain application/graphql-response+json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 2. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
    - - 3. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
    - - 4. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
    - - 5. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
    - - 6. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
    - - 7. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 8. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 9. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 10. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 11. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
    - - 12. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
    - - 13. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
    - - 14. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
    - - 15. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 16. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" +* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 78 audits in total
      • +
    • ✅ 45 pass
      • +
    • ⚠️ 33 warnings (optional)
      • +
    + +

    Passing

    +
      +
    1. 4655 MUST accept application/json and match the content-type
      2. +
    2. 47DE SHOULD accept */* and use application/json for the content-type
      3. +
    3. 80D8 SHOULD assume application/json content-type when accept is missing
      4. +
    4. 82A3 MUST use utf-8 encoding when responding
      5. +
    5. BF61 MUST accept utf-8 encoded request
      6. +
    6. 78D5 MUST assume utf-8 in request if encoding is unspecified
      7. +
    7. 2C94 MUST accept POST requests
      8. +
    8. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      9. +
    9. 9C48 MAY NOT allow executing mutations on GET requests
      10. +
    10. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      11. +
    11. 03D4 MUST accept application/json POST requests
      12. +
    12. 7267 MUST require a request body on POST
      13. +
    13. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      14. +
    14. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      15. +
    15. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      16. +
    16. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      17. +
    17. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      18. +
    18. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      19. +
    19. 13EE MUST allow string {query} parameter when accepting application/json
      20. +
    20. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      21. +
    21. B8B3 MUST allow string {operationName} parameter when accepting application/json
      22. +
    22. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      23. +
    23. 0220 MUST allow null {variables} parameter when accepting application/json
      24. +
    24. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      25. +
    25. 0221 MUST allow null {operationName} parameter when accepting application/json
      26. +
    26. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      27. +
    27. 0222 MUST allow null {extensions} parameter when accepting application/json
      28. +
    28. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      29. +
    29. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      30. +
    30. 28B9 MUST allow map {variables} parameter when accepting application/json
      31. +
    31. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      32. +
    32. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      33. +
    33. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      34. +
    34. 1B7A MUST allow map {extensions} parameter when accepting application/json
      35. +
    35. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      36. +
    36. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      37. +
    37. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      38. +
    38. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      39. +
    39. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      40. +
    40. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      41. +
    41. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      42. +
    42. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      43. +
    43. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      44. +
    44. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      45. +
    45. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      46. +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      +Response header content-type does not contain application/graphql-response+json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      2. +
    2. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide query string."
+      }
+    ]
+  }
+}
+
      +
      +
      3. +
    3. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide query string."
+      }
+    ]
+  }
+}
+
      +
      +
      4. +
    4. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide query string."
+      }
+    ]
+  }
+}
+
      +
      +
      5. +
    5. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide query string."
+      }
+    ]
+  }
+}
+
      +
      +
      6. +
    6. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide query string."
+      }
+    ]
+  }
+}
+
      +
      +
      7. +
    7. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      8. +
    8. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      9. +
    9. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      10. +
    10. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      11. +
    11. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      12. +
    12. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      13. +
    13. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      14. +
    14. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      15. +
    15. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      16. +
    16. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      17. +
    17. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      18. +
    18. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"36-+LiPix1LCLv9gfzrc5wfPL4GHbM\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "54",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Variables are invalid JSON."
+      }
+    ]
+  }
+}
+
      +
      +
      19. +
    19. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      20. +
    20. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      21. +
    21. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      22. +
    22. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      23. +
    23. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      24. +
    24. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      25. +
    25. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      26. +
    26. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      27. +
    27. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      28. +
    28. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      29. +
    29. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      30. +
    30. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"37-xijHDWdp/snSS4p0BKd+UCmvfYk\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "55",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "POST body sent invalid JSON."
+      }
+    ]
+  }
+}
+
      +
      +
      31. +
    31. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide query string."
+      }
+    ]
+  }
+}
+
      +
      +
      32. +
    32. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"68-Xc/MwYKGMF54XYivaA3tsxvGHZM\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "104",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
           }
-        }
-      }
-      ```
-
      - - 17. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" + ] + } + ] + } +} + +
      +
      33. +
    33. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "etag": "W/\"7b-vh2QJW5nlT/MclH/TbhHlNDXWZE\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "123",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
           }
-        }
-      }
-      ```
-
      - - 18. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"36-+LiPix1LCLv9gfzrc5wfPL4GHbM\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "54", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Variables are invalid JSON." - } - ] - } - } - ``` -
      - - 19. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 20. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 21. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 22. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
      - - 23. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
      - - 24. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
      - - 25. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
      - - 26. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 27. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 28. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 29. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 30. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"37-xijHDWdp/snSS4p0BKd+UCmvfYk\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "55", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "POST body sent invalid JSON." - } - ] - } - } - ``` -
      - - 31. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"35-rkfaW07yp80JIwkYI6hoaXIO3bI\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
      - - 32. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"68-Xc/MwYKGMF54XYivaA3tsxvGHZM\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "104", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Expected Name, found .", - "locations": [ - { - "line": 1, - "column": 2 - } - ] - } - ] - } - } - ``` -
      - - 33. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "etag": "W/\"7b-vh2QJW5nlT/MclH/TbhHlNDXWZE\"", - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "123", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Invalid number, expected digit but got: \"f\".", - "locations": [ - { - "line": 1, - "column": 4 - } - ] - } - ] - } - } - ``` -
      - + ] + } + ] + } +} +       +
    + + diff --git a/implementations/graph-client/README.md b/implementations/graph-client/README.md index a1c8df42..42869bdd 100644 --- a/implementations/graph-client/README.md +++ b/implementations/graph-client/README.md @@ -1,87 +1,91 @@ -_* This report was auto-generated by graphql-http_ +* This report was auto-generated by graphql-http -# GraphQL over HTTP audit report +

    GraphQL over HTTP audit report

    -- **78** audits in total -- ✅ **78** pass +
      +
    • 78 audits in total
      • +
    • ✅ 78 pass
      • +
    -## Passing -1. `22EB` SHOULD accept application/graphql-response+json and match the content-type -2. `4655` MUST accept application/json and match the content-type -3. `47DE` SHOULD accept \*/\* and use application/json for the content-type -4. `80D8` SHOULD assume application/json content-type when accept is missing -5. `82A3` MUST use utf-8 encoding when responding -6. `BF61` MUST accept utf-8 encoded request -7. `78D5` MUST assume utf-8 in request if encoding is unspecified -8. `2C94` MUST accept POST requests -9. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -10. `9C48` MAY NOT allow executing mutations on GET requests -11. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -12. `03D4` MUST accept application/json POST requests -13. `7267` MUST require a request body on POST -14. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -15. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json -16. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -17. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -18. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -19. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -20. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json -21. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -22. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -23. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json -24. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -25. `13EE` MUST allow string {query} parameter when accepting application/json -26. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -27. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -28. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -29. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -30. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json -31. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -32. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -33. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json -34. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -35. `B8B3` MUST allow string {operationName} parameter when accepting application/json -36. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -37. `0220` MUST allow null {variables} parameter when accepting application/json -38. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -39. `0221` MUST allow null {operationName} parameter when accepting application/json -40. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -41. `0222` MUST allow null {extensions} parameter when accepting application/json -42. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -43. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -44. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -45. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -46. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json -47. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json -48. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json -49. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json -50. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -51. `28B9` MUST allow map {variables} parameter when accepting application/json -52. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -53. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -54. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -55. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json -56. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json -57. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json -58. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json -59. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json -60. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json -61. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json -62. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -63. `1B7A` MUST allow map {extensions} parameter when accepting application/json -64. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json -65. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json -66. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json -67. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json -68. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -69. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -70. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -71. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -72. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -73. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -74. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -75. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -76. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -77. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -78. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +

    Passing

    +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 4655 MUST accept application/json and match the content-type
      3. +
    3. 47DE SHOULD accept */* and use application/json for the content-type
      4. +
    4. 80D8 SHOULD assume application/json content-type when accept is missing
      5. +
    5. 82A3 MUST use utf-8 encoding when responding
      6. +
    6. BF61 MUST accept utf-8 encoded request
      7. +
    7. 78D5 MUST assume utf-8 in request if encoding is unspecified
      8. +
    8. 2C94 MUST accept POST requests
      9. +
    9. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      10. +
    10. 9C48 MAY NOT allow executing mutations on GET requests
      11. +
    11. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      12. +
    12. 03D4 MUST accept application/json POST requests
      13. +
    13. 7267 MUST require a request body on POST
      14. +
    14. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      15. +
    15. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
      16. +
    16. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      17. +
    17. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      18. +
    18. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      19. +
    19. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      20. +
    20. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
      21. +
    21. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      22. +
    22. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      23. +
    23. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
      24. +
    24. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      25. +
    25. 13EE MUST allow string {query} parameter when accepting application/json
      26. +
    26. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      27. +
    27. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      28. +
    28. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      29. +
    29. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      30. +
    30. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      31. +
    31. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      32. +
    32. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      33. +
    33. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      34. +
    34. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      35. +
    35. B8B3 MUST allow string {operationName} parameter when accepting application/json
      36. +
    36. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      37. +
    37. 0220 MUST allow null {variables} parameter when accepting application/json
      38. +
    38. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      39. +
    39. 0221 MUST allow null {operationName} parameter when accepting application/json
      40. +
    40. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      41. +
    41. 0222 MUST allow null {extensions} parameter when accepting application/json
      42. +
    42. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      43. +
    43. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      44. +
    44. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      45. +
    45. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      46. +
    46. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      47. +
    47. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      48. +
    48. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      49. +
    49. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      50. +
    50. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      51. +
    51. 28B9 MUST allow map {variables} parameter when accepting application/json
      52. +
    52. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      53. +
    53. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      54. +
    54. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      55. +
    55. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      56. +
    56. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      57. +
    57. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      58. +
    58. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      59. +
    59. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      60. +
    60. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      61. +
    61. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      62. +
    62. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      63. +
    63. 1B7A MUST allow map {extensions} parameter when accepting application/json
      64. +
    64. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json
      65. +
    65. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json
      66. +
    66. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      67. +
    67. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      68. +
    68. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      69. +
    69. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      70. +
    70. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      71. +
    71. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      72. +
    72. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      73. +
    73. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      74. +
    74. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      75. +
    75. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      76. +
    76. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      77. +
    77. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      78. +
    78. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      79. +
    diff --git a/implementations/graphql-helix/README.md b/implementations/graphql-helix/README.md index f71435ba..e4e7cb34 100644 --- a/implementations/graphql-helix/README.md +++ b/implementations/graphql-helix/README.md @@ -1,788 +1,706 @@ -_* This report was auto-generated by graphql-http_ - -# GraphQL over HTTP audit report - -- **78** audits in total -- ✅ **49** pass -- ⚠️ **29** warnings (optional) - -## Passing -1. `4655` MUST accept application/json and match the content-type -2. `47DE` SHOULD accept \*/\* and use application/json for the content-type -3. `80D8` SHOULD assume application/json content-type when accept is missing -4. `82A3` MUST use utf-8 encoding when responding -5. `BF61` MUST accept utf-8 encoded request -6. `78D5` MUST assume utf-8 in request if encoding is unspecified -7. `2C94` MUST accept POST requests -8. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -9. `9C48` MAY NOT allow executing mutations on GET requests -10. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -11. `03D4` MUST accept application/json POST requests -12. `7267` MUST require a request body on POST -13. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -14. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -15. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -16. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -17. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -18. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -19. `13EE` MUST allow string {query} parameter when accepting application/json -20. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -21. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -22. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -23. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -24. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -25. `B8B3` MUST allow string {operationName} parameter when accepting application/json -26. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -27. `0220` MUST allow null {variables} parameter when accepting application/json -28. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -29. `0221` MUST allow null {operationName} parameter when accepting application/json -30. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -31. `0222` MUST allow null {extensions} parameter when accepting application/json -32. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -33. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -34. `28B9` MUST allow map {variables} parameter when accepting application/json -35. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -36. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -37. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -38. `1B7A` MUST allow map {extensions} parameter when accepting application/json -39. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -40. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -41. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -42. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -43. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -44. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -45. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -46. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -47. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -48. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -49. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json - -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `22EB` SHOULD accept application/graphql-response+json and match the content-type
    - -
    - Response header content-type does not contain application/graphql-response+json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 2. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
    - - 3. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "15", - "connection": "close" - }, - "body": { - "errors": [ - {} - ] - } - } - ``` -
    - - 4. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "15", - "connection": "close" - }, - "body": { - "errors": [ - {} - ] - } - } - ``` -
    - - 5. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "15", - "connection": "close" - }, - "body": { - "errors": [ - {} - ] - } - } - ``` -
    - - 6. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "15", - "connection": "close" - }, - "body": { - "errors": [ - {} - ] - } - } - ``` -
    - - 7. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Could not determine what operation to execute." - } - ] - } - } - ``` -
    - - 8. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Could not determine what operation to execute." - } - ] - } - } - ``` -
    - - 9. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Could not determine what operation to execute." - } - ] - } - } - ``` -
    - - 10. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Could not determine what operation to execute." - } - ] - } - } - ``` -
    - - 11. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 12. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 13. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json +* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 78 audits in total
      • +
    • ✅ 49 pass
      • +
    • ⚠️ 29 warnings (optional)
      • +
    + +

    Passing

    +
      +
    1. 4655 MUST accept application/json and match the content-type
      2. +
    2. 47DE SHOULD accept */* and use application/json for the content-type
      3. +
    3. 80D8 SHOULD assume application/json content-type when accept is missing
      4. +
    4. 82A3 MUST use utf-8 encoding when responding
      5. +
    5. BF61 MUST accept utf-8 encoded request
      6. +
    6. 78D5 MUST assume utf-8 in request if encoding is unspecified
      7. +
    7. 2C94 MUST accept POST requests
      8. +
    8. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      9. +
    9. 9C48 MAY NOT allow executing mutations on GET requests
      10. +
    10. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      11. +
    11. 03D4 MUST accept application/json POST requests
      12. +
    12. 7267 MUST require a request body on POST
      13. +
    13. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      14. +
    14. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      15. +
    15. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      16. +
    16. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      17. +
    17. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      18. +
    18. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      19. +
    19. 13EE MUST allow string {query} parameter when accepting application/json
      20. +
    20. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      21. +
    21. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      22. +
    22. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      23. +
    23. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      24. +
    24. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      25. +
    25. B8B3 MUST allow string {operationName} parameter when accepting application/json
      26. +
    26. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      27. +
    27. 0220 MUST allow null {variables} parameter when accepting application/json
      28. +
    28. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      29. +
    29. 0221 MUST allow null {operationName} parameter when accepting application/json
      30. +
    30. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      31. +
    31. 0222 MUST allow null {extensions} parameter when accepting application/json
      32. +
    32. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      33. +
    33. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      34. +
    34. 28B9 MUST allow map {variables} parameter when accepting application/json
      35. +
    35. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      36. +
    36. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      37. +
    37. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      38. +
    38. 1B7A MUST allow map {extensions} parameter when accepting application/json
      39. +
    39. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      40. +
    40. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      41. +
    41. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      42. +
    42. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      43. +
    43. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      44. +
    44. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      45. +
    45. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      46. +
    46. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      47. +
    47. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      48. +
    48. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      49. +
    49. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      50. +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      +Response header content-type does not contain application/graphql-response+json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      2. +
    2. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": {
-          "data": {
-            "__typename": "Query"
-          }
-        }
+        "message": "Must provide query string."
       }
-      ```
-
      - - 14. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      3. +
    3. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "15",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {}
+    ]
+  }
+}
+
      +
      +
      4. +
    4. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "15",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {}
+    ]
+  }
+}
+
      +
      +
      5. +
    5. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "15",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {}
+    ]
+  }
+}
+
      +
      +
      6. +
    6. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "15",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {}
+    ]
+  }
+}
+
      +
      +
      7. +
    7. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "54",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Variables are invalid JSON."
-            }
-          ]
-        }
+        "message": "Could not determine what operation to execute."
       }
-      ```
-
      - - 15. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json + ] + } +} + +
      +
      8. +
    8. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Could not determine what operation to execute."
       }
-      ```
-
      - - 16. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json + ] + } +} + +
      +
      9. +
    9. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Could not determine what operation to execute."
       }
-      ```
-
      - - 17. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json + ] + } +} + +
      +
      10. +
    10. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Could not determine what operation to execute."
       }
-      ```
-
      - - 18. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json + ] + } +} + +
      +
      11. +
    11. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      12. +
    12. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      13. +
    13. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      14. +
    14. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "54",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": {
-          "data": {
-            "__typename": "Query"
-          }
-        }
+        "message": "Variables are invalid JSON."
       }
-      ```
-
      - - 19. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json + ] + } +} + +
      +
      15. +
    15. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      16. +
    16. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      17. +
    17. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      18. +
    18. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      19. +
    19. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      20. +
    20. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      21. +
    21. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      22. +
    22. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      23. +
    23. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      24. +
    24. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      25. +
    25. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      26. +
    26. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "x-content-type-options": "nosniff",
+    "date": "",
+    "content-type": "text/html; charset=utf-8",
+    "content-security-policy": "default-src 'none'",
+    "content-length": "1108",
+    "connection": "close"
+  },
+  "body": "\n\n\n\nError\n\n\n
      SyntaxError: Unexpected end of JSON input
          at JSON.parse (<anonymous>)
          at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)
          at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18
          at AsyncResource.runInAsyncScope (node:async_hooks:204:9)
          at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)
          at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)
          at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)
          at IncomingMessage.emit (node:events:513:28)
          at endReadableNT (node:internal/streams/readable:1359:12)
          at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
      \n\n\n"
+}
+
      +
      +
      27. +
    27. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "53",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": {
-          "data": {
-            "__typename": "Query"
-          }
-        }
+        "message": "Must provide query string."
       }
-      ```
-
      - - 20. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json + ] + } +} + +
      +
      28. +
    28. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "104",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": {
-          "data": {
-            "__typename": "Query"
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
           }
-        }
+        ]
       }
-      ```
-
      - - 21. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json + ] + } +} + +
      +
      29. +
    29. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "x-powered-by": "Express",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "123",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "x-powered-by": "Express",
-          "date": "",
-          "content-type": "application/json",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": {
-          "data": {
-            "__typename": "Query"
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
           }
-        }
-      }
-      ```
-
      - - 22. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 23. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 24. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 25. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 26. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "x-content-type-options": "nosniff", - "date": "", - "content-type": "text/html; charset=utf-8", - "content-security-policy": "default-src 'none'", - "content-length": "1108", - "connection": "close" - }, - "body": "\n\n\n\nError\n\n\n
      SyntaxError: Unexpected end of JSON input
          at JSON.parse (<anonymous>)
          at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)
          at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18
          at AsyncResource.runInAsyncScope (node:async_hooks:204:9)
          at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)
          at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)
          at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)
          at IncomingMessage.emit (node:events:513:28)
          at endReadableNT (node:internal/streams/readable:1359:12)
          at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
      \n\n\n" - } - ``` -
      - - 27. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "53", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide query string." - } - ] - } - } - ``` -
      - - 28. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "104", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Expected Name, found .", - "locations": [ - { - "line": 1, - "column": 2 - } - ] - } - ] - } - } - ``` -
      - - 29. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "x-powered-by": "Express", - "date": "", - "content-type": "application/json", - "content-length": "123", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Invalid number, expected digit but got: \"f\".", - "locations": [ - { - "line": 1, - "column": 4 - } - ] - } - ] - } + ] } - ``` -
      - + ] + } +} +       +
    + + diff --git a/implementations/graphql-yoga/README.md b/implementations/graphql-yoga/README.md index a1c8df42..42869bdd 100644 --- a/implementations/graphql-yoga/README.md +++ b/implementations/graphql-yoga/README.md @@ -1,87 +1,91 @@ -_* This report was auto-generated by graphql-http_ +* This report was auto-generated by graphql-http -# GraphQL over HTTP audit report +

    GraphQL over HTTP audit report

    -- **78** audits in total -- ✅ **78** pass +
      +
    • 78 audits in total
      • +
    • ✅ 78 pass
      • +
    -## Passing -1. `22EB` SHOULD accept application/graphql-response+json and match the content-type -2. `4655` MUST accept application/json and match the content-type -3. `47DE` SHOULD accept \*/\* and use application/json for the content-type -4. `80D8` SHOULD assume application/json content-type when accept is missing -5. `82A3` MUST use utf-8 encoding when responding -6. `BF61` MUST accept utf-8 encoded request -7. `78D5` MUST assume utf-8 in request if encoding is unspecified -8. `2C94` MUST accept POST requests -9. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -10. `9C48` MAY NOT allow executing mutations on GET requests -11. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -12. `03D4` MUST accept application/json POST requests -13. `7267` MUST require a request body on POST -14. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -15. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json -16. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -17. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -18. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -19. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -20. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json -21. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -22. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -23. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json -24. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -25. `13EE` MUST allow string {query} parameter when accepting application/json -26. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -27. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -28. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -29. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -30. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json -31. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -32. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -33. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json -34. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -35. `B8B3` MUST allow string {operationName} parameter when accepting application/json -36. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -37. `0220` MUST allow null {variables} parameter when accepting application/json -38. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -39. `0221` MUST allow null {operationName} parameter when accepting application/json -40. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -41. `0222` MUST allow null {extensions} parameter when accepting application/json -42. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -43. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -44. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -45. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -46. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json -47. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json -48. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json -49. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json -50. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -51. `28B9` MUST allow map {variables} parameter when accepting application/json -52. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -53. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -54. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -55. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json -56. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json -57. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json -58. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json -59. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json -60. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json -61. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json -62. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -63. `1B7A` MUST allow map {extensions} parameter when accepting application/json -64. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json -65. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json -66. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json -67. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json -68. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -69. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -70. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -71. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -72. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -73. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -74. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -75. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -76. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -77. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -78. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +

    Passing

    +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 4655 MUST accept application/json and match the content-type
      3. +
    3. 47DE SHOULD accept */* and use application/json for the content-type
      4. +
    4. 80D8 SHOULD assume application/json content-type when accept is missing
      5. +
    5. 82A3 MUST use utf-8 encoding when responding
      6. +
    6. BF61 MUST accept utf-8 encoded request
      7. +
    7. 78D5 MUST assume utf-8 in request if encoding is unspecified
      8. +
    8. 2C94 MUST accept POST requests
      9. +
    9. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      10. +
    10. 9C48 MAY NOT allow executing mutations on GET requests
      11. +
    11. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      12. +
    12. 03D4 MUST accept application/json POST requests
      13. +
    13. 7267 MUST require a request body on POST
      14. +
    14. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      15. +
    15. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
      16. +
    16. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      17. +
    17. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      18. +
    18. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      19. +
    19. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      20. +
    20. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
      21. +
    21. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      22. +
    22. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      23. +
    23. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
      24. +
    24. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      25. +
    25. 13EE MUST allow string {query} parameter when accepting application/json
      26. +
    26. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      27. +
    27. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      28. +
    28. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      29. +
    29. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      30. +
    30. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      31. +
    31. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      32. +
    32. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      33. +
    33. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      34. +
    34. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      35. +
    35. B8B3 MUST allow string {operationName} parameter when accepting application/json
      36. +
    36. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      37. +
    37. 0220 MUST allow null {variables} parameter when accepting application/json
      38. +
    38. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      39. +
    39. 0221 MUST allow null {operationName} parameter when accepting application/json
      40. +
    40. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      41. +
    41. 0222 MUST allow null {extensions} parameter when accepting application/json
      42. +
    42. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      43. +
    43. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      44. +
    44. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      45. +
    45. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      46. +
    46. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      47. +
    47. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      48. +
    48. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      49. +
    49. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      50. +
    50. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      51. +
    51. 28B9 MUST allow map {variables} parameter when accepting application/json
      52. +
    52. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      53. +
    53. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      54. +
    54. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      55. +
    55. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      56. +
    56. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      57. +
    57. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      58. +
    58. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      59. +
    59. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      60. +
    60. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      61. +
    61. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      62. +
    62. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      63. +
    63. 1B7A MUST allow map {extensions} parameter when accepting application/json
      64. +
    64. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json
      65. +
    65. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json
      66. +
    66. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      67. +
    67. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      68. +
    68. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      69. +
    69. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      70. +
    70. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      71. +
    71. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      72. +
    72. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      73. +
    73. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      74. +
    74. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      75. +
    75. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      76. +
    76. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      77. +
    77. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      78. +
    78. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      79. +
    diff --git a/implementations/hotchocolate/README.md b/implementations/hotchocolate/README.md index 76e1b5e9..ffc92510 100644 --- a/implementations/hotchocolate/README.md +++ b/implementations/hotchocolate/README.md @@ -1,140 +1,139 @@ -_* This report was auto-generated by graphql-http_ +* This report was auto-generated by graphql-http -# GraphQL over HTTP audit report +

    GraphQL over HTTP audit report

    -- **78** audits in total -- ✅ **76** pass -- ⚠️ **2** warnings (optional) +
      +
    • 78 audits in total
      • +
    • ✅ 76 pass
      • +
    • ⚠️ 2 warnings (optional)
      • +
    -## Passing -1. `22EB` SHOULD accept application/graphql-response+json and match the content-type -2. `4655` MUST accept application/json and match the content-type -3. `82A3` MUST use utf-8 encoding when responding -4. `BF61` MUST accept utf-8 encoded request -5. `78D5` MUST assume utf-8 in request if encoding is unspecified -6. `2C94` MUST accept POST requests -7. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -8. `9C48` MAY NOT allow executing mutations on GET requests -9. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -10. `03D4` MUST accept application/json POST requests -11. `7267` MUST require a request body on POST -12. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -13. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json -14. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -15. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -16. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -17. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -18. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json -19. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -20. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -21. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json -22. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -23. `13EE` MUST allow string {query} parameter when accepting application/json -24. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -25. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -26. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -27. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -28. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json -29. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -30. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -31. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json -32. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -33. `B8B3` MUST allow string {operationName} parameter when accepting application/json -34. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -35. `0220` MUST allow null {variables} parameter when accepting application/json -36. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -37. `0221` MUST allow null {operationName} parameter when accepting application/json -38. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -39. `0222` MUST allow null {extensions} parameter when accepting application/json -40. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -41. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -42. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -43. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -44. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json -45. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json -46. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json -47. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json -48. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -49. `28B9` MUST allow map {variables} parameter when accepting application/json -50. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -51. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -52. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -53. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json -54. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json -55. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json -56. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json -57. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json -58. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json -59. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json -60. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -61. `1B7A` MUST allow map {extensions} parameter when accepting application/json -62. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json -63. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json -64. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json -65. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json -66. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -67. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -68. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -69. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -70. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -71. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -72. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -73. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -74. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -75. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -76. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +

    Passing

    +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 4655 MUST accept application/json and match the content-type
      3. +
    3. 82A3 MUST use utf-8 encoding when responding
      4. +
    4. BF61 MUST accept utf-8 encoded request
      5. +
    5. 78D5 MUST assume utf-8 in request if encoding is unspecified
      6. +
    6. 2C94 MUST accept POST requests
      7. +
    7. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      8. +
    8. 9C48 MAY NOT allow executing mutations on GET requests
      9. +
    9. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      10. +
    10. 03D4 MUST accept application/json POST requests
      11. +
    11. 7267 MUST require a request body on POST
      12. +
    12. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      13. +
    13. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
      14. +
    14. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      15. +
    15. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      16. +
    16. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      17. +
    17. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      18. +
    18. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
      19. +
    19. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      20. +
    20. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      21. +
    21. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
      22. +
    22. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      23. +
    23. 13EE MUST allow string {query} parameter when accepting application/json
      24. +
    24. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      25. +
    25. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      26. +
    26. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      27. +
    27. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      28. +
    28. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      29. +
    29. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      30. +
    30. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      31. +
    31. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      32. +
    32. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      33. +
    33. B8B3 MUST allow string {operationName} parameter when accepting application/json
      34. +
    34. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      35. +
    35. 0220 MUST allow null {variables} parameter when accepting application/json
      36. +
    36. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      37. +
    37. 0221 MUST allow null {operationName} parameter when accepting application/json
      38. +
    38. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      39. +
    39. 0222 MUST allow null {extensions} parameter when accepting application/json
      40. +
    40. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      41. +
    41. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      42. +
    42. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      43. +
    43. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      44. +
    44. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      45. +
    45. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      46. +
    46. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      47. +
    47. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      48. +
    48. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      49. +
    49. 28B9 MUST allow map {variables} parameter when accepting application/json
      50. +
    50. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      51. +
    51. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      52. +
    52. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      53. +
    53. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      54. +
    54. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      55. +
    55. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      56. +
    56. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      57. +
    57. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      58. +
    58. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      59. +
    59. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      60. +
    60. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      61. +
    61. 1B7A MUST allow map {extensions} parameter when accepting application/json
      62. +
    62. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json
      63. +
    63. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json
      64. +
    64. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      65. +
    65. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      66. +
    66. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      67. +
    67. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      68. +
    68. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      69. +
    69. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      70. +
    70. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      71. +
    71. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      72. +
    72. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      73. +
    73. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      74. +
    74. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      75. +
    75. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      76. +
    76. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      77. +
    -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `47DE` SHOULD accept \*/\* and use application/json for the content-type
    - -
    - Response header content-type does not contain application/json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "transfer-encoding": "chunked", - "server": "Kestrel", - "date": "", - "content-type": "application/graphql-response+json;charset=utf-8", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 2. `80D8` SHOULD assume application/json content-type when accept is missing
    - -
    - Response header content-type does not contain application/json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "transfer-encoding": "chunked", - "server": "Kestrel", - "date": "", - "content-type": "application/graphql-response+json;charset=utf-8", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 47DE SHOULD accept */* and use application/json for the content-type +
      +Response header content-type does not contain application/json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "transfer-encoding": "chunked",
+    "server": "Kestrel",
+    "date": "",
+    "content-type": "application/graphql-response+json;charset=utf-8",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      2. +
    2. 80D8 SHOULD assume application/json content-type when accept is missing +
      +Response header content-type does not contain application/json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "transfer-encoding": "chunked",
+    "server": "Kestrel",
+    "date": "",
+    "content-type": "application/graphql-response+json;charset=utf-8",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      3. +
    diff --git a/implementations/mercurius/README.md b/implementations/mercurius/README.md index d2c68f42..0bfd1d55 100644 --- a/implementations/mercurius/README.md +++ b/implementations/mercurius/README.md @@ -1,824 +1,743 @@ -_* This report was auto-generated by graphql-http_ - -# GraphQL over HTTP audit report - -- **78** audits in total -- ✅ **49** pass -- ⚠️ **28** warnings (optional) -- ❌ **1** errors (required) - -## Passing -1. `4655` MUST accept application/json and match the content-type -2. `47DE` SHOULD accept \*/\* and use application/json for the content-type -3. `80D8` SHOULD assume application/json content-type when accept is missing -4. `82A3` MUST use utf-8 encoding when responding -5. `BF61` MUST accept utf-8 encoded request -6. `78D5` MUST assume utf-8 in request if encoding is unspecified -7. `2C94` MUST accept POST requests -8. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -9. `9C48` MAY NOT allow executing mutations on GET requests -10. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -11. `03D4` MUST accept application/json POST requests -12. `7267` MUST require a request body on POST -13. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -14. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -15. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -16. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -17. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -18. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -19. `13EE` MUST allow string {query} parameter when accepting application/json -20. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -21. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -22. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -23. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -24. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -25. `B8B3` MUST allow string {operationName} parameter when accepting application/json -26. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -27. `0220` MUST allow null {variables} parameter when accepting application/json -28. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -29. `0221` MUST allow null {operationName} parameter when accepting application/json -30. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -31. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -32. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -33. `28B9` MUST allow map {variables} parameter when accepting application/json -34. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -35. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -36. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -37. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json -38. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json -39. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json -40. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -41. `1B7A` MUST allow map {extensions} parameter when accepting application/json -42. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -43. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -44. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -45. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -46. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -47. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -48. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -49. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json - -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `22EB` SHOULD accept application/graphql-response+json and match the content-type
    - -
    - Response header content-type does not contain application/graphql-response+json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 2. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "52", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Unknown query" - } - ], - "data": null - } - } - ``` -
    - - 3. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "61", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide document." - } - ], - "data": null - } - } - ``` -
    - - 4. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "61", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide document." - } - ], - "data": null - } - } - ``` -
    - - 5. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "64", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "body/query must be string" - } - ], - "data": null - } - } - ``` -
    - - 6. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "115", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Unexpected Name \"array\".", - "locations": [ - { - "line": 1, - "column": 1 - } - ] - } - ], - "data": null - } - } - ``` -
    - - 7. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "69", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Unknown operation named \"0\"." - } - ], - "data": null - } - } - ``` -
    - - 8. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json +* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 78 audits in total
      • +
    • ✅ 49 pass
      • +
    • ⚠️ 28 warnings (optional)
      • +
    • ❌ 1 errors (required)
      • +
    + +

    Passing

    +
      +
    1. 4655 MUST accept application/json and match the content-type
      2. +
    2. 47DE SHOULD accept */* and use application/json for the content-type
      3. +
    3. 80D8 SHOULD assume application/json content-type when accept is missing
      4. +
    4. 82A3 MUST use utf-8 encoding when responding
      5. +
    5. BF61 MUST accept utf-8 encoded request
      6. +
    6. 78D5 MUST assume utf-8 in request if encoding is unspecified
      7. +
    7. 2C94 MUST accept POST requests
      8. +
    8. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      9. +
    9. 9C48 MAY NOT allow executing mutations on GET requests
      10. +
    10. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      11. +
    11. 03D4 MUST accept application/json POST requests
      12. +
    12. 7267 MUST require a request body on POST
      13. +
    13. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      14. +
    14. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      15. +
    15. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      16. +
    16. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      17. +
    17. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      18. +
    18. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      19. +
    19. 13EE MUST allow string {query} parameter when accepting application/json
      20. +
    20. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      21. +
    21. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      22. +
    22. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      23. +
    23. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      24. +
    24. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      25. +
    25. B8B3 MUST allow string {operationName} parameter when accepting application/json
      26. +
    26. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      27. +
    27. 0220 MUST allow null {variables} parameter when accepting application/json
      28. +
    28. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      29. +
    29. 0221 MUST allow null {operationName} parameter when accepting application/json
      30. +
    30. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      31. +
    31. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      32. +
    32. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      33. +
    33. 28B9 MUST allow map {variables} parameter when accepting application/json
      34. +
    34. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      35. +
    35. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      36. +
    36. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      37. +
    37. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      38. +
    38. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      39. +
    39. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      40. +
    40. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      41. +
    41. 1B7A MUST allow map {extensions} parameter when accepting application/json
      42. +
    42. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      43. +
    43. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      44. +
    44. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      45. +
    45. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      46. +
    46. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      47. +
    47. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      48. +
    48. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      49. +
    49. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      50. +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      +Response header content-type does not contain application/graphql-response+json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      2. +
    2. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "52",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "73",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Unknown operation named \"false\"."
-            }
-          ],
-          "data": null
-        }
+        "message": "Unknown query"
       }
-      ```
-
      - - 9. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      3. +
    3. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "61",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "77",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/operationName must be string,null"
-            }
-          ],
-          "data": null
-        }
+        "message": "Must provide document."
       }
-      ```
-
      - - 10. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      4. +
    4. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "61",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "77",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/operationName must be string,null"
-            }
-          ],
-          "data": null
-        }
+        "message": "Must provide document."
       }
-      ```
-
      - - 11. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      5. +
    5. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "64",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "69",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/extensions must be object"
-            }
-          ],
-          "data": null
-        }
-      }
-      ```
-
      - - 12. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } + "message": "body/query must be string" } - ``` -
      - - 13. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json + ], + "data": null + } +} + +
      +
      6. +
    6. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "115",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": {
-          "data": {
-            "__typename": "Query"
+        "message": "Syntax Error: Unexpected Name \"array\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 1
           }
-        }
+        ]
       }
-      ```
-
      - - 14. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      7. +
    7. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "73",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/variables must be object,null"
-            }
-          ],
-          "data": null
-        }
+        "message": "Unknown operation named \"0\"."
       }
-      ```
-
      - - 15. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json + ], + "data": null + } +} + +
      +
      8. +
    8. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Unknown operation named \"false\"."
       }
-      ```
-
      - - 16. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json + ], + "data": null + } +} + +
      +
      9. +
    9. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "77",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "OK",
-        "status": 200,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "31",
-          "connection": "close"
-        },
-        "body": null
+        "message": "body/operationName must be string,null"
       }
-      ```
-
      - - 17. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      10. +
    10. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "77",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "73",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/variables must be object,null"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/operationName must be string,null"
       }
-      ```
-
      - - 18. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      11. +
    11. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "69",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/extensions must be object"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/extensions must be object"
       }
-      ```
-
      - - 19. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      12. +
    12. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      13. +
    13. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      14. +
    14. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "69",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/extensions must be object"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/variables must be object,null"
       }
-      ```
-
      - - 20. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      15. +
    15. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      16. +
    16. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      17. +
    17. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "69",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/extensions must be object"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/variables must be object,null"
       }
-      ```
-
      - - 21. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      18. +
    18. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "69",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/extensions must be object"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/extensions must be object"
       }
-      ```
-
      - - 22. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      19. +
    19. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "67",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Unexpected end of JSON input"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/extensions must be object"
       }
-      ```
-
      - - 23. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      20. +
    20. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "52",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Unknown query"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/extensions must be object"
       }
-      ```
-
      - - 24. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      21. +
    21. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "116",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Syntax Error: Expected Name, found .",
-              "locations": [
-                {
-                  "line": 1,
-                  "column": 2
-                }
-              ]
-            }
-          ],
-          "data": null
-        }
+        "message": "body/extensions must be object"
       }
-      ```
-
      - - 25. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      22. +
    22. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "67",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "135",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
-              "locations": [
-                {
-                  "line": 1,
-                  "column": 4
-                }
-              ]
-            }
-          ],
-          "data": null
-        }
+        "message": "Unexpected end of JSON input"
       }
-      ```
-
      - - 26. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      - -
      - Response body execution result data is not "undefined" - - ```json + ], + "data": null + } +} + +
      +
      23. +
    23. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "52",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "52",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Unknown query"
       }
-      ```
-
      - - 27. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      - -
      - Response body execution result data is not "undefined" - - ```json + ], + "data": null + } +} + +
      +
      24. +
    24. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "116",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "116",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
+          }
+        ]
       }
-      ```
-
      - - 28. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      - -
      - Response body execution result data is not "undefined" - - ```json + ], + "data": null + } +} + +
      +
      25. +
    25. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "135",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "135",
-          "connection": "close"
-        },
-        "body": null
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
+          }
+        ]
       }
-      ```
-
      - - -## Errors -The server _MUST_ support these. - - 1. `0222` MUST allow null {extensions} parameter when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ], + "data": null + } +} + +
      +
      26. +
    26. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json +
      +Response body execution result data is not "undefined" +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "52",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      27. +
    27. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json +
      +Response body execution result data is not "undefined" +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "116",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      28. +
    28. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +
      +Response body execution result data is not "undefined" +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "135",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      29. +
    + +

    Errors

    +The server MUST support these. +
      +
    1. 0222 MUST allow null {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "69",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "message": "body/extensions must be object"
-            }
-          ],
-          "data": null
-        }
+        "message": "body/extensions must be object"
       }
-      ```
-
      - + ], + "data": null + } +} + +
    + + diff --git a/implementations/pioneer/README.md b/implementations/pioneer/README.md index b751945f..c1e09a45 100644 --- a/implementations/pioneer/README.md +++ b/implementations/pioneer/README.md @@ -1,170 +1,166 @@ -_* This report was auto-generated by graphql-http_ +* This report was auto-generated by graphql-http -# GraphQL over HTTP audit report +

    GraphQL over HTTP audit report

    -- **78** audits in total -- ✅ **75** pass -- ⚠️ **3** warnings (optional) +
      +
    • 78 audits in total
      • +
    • ✅ 75 pass
      • +
    • ⚠️ 3 warnings (optional)
      • +
    -## Passing -1. `22EB` SHOULD accept application/graphql-response+json and match the content-type -2. `4655` MUST accept application/json and match the content-type -3. `47DE` SHOULD accept \*/\* and use application/json for the content-type -4. `80D8` SHOULD assume application/json content-type when accept is missing -5. `82A3` MUST use utf-8 encoding when responding -6. `BF61` MUST accept utf-8 encoded request -7. `78D5` MUST assume utf-8 in request if encoding is unspecified -8. `2C94` MUST accept POST requests -9. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -10. `9C48` MAY NOT allow executing mutations on GET requests -11. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -12. `03D4` MUST accept application/json POST requests -13. `7267` MUST require a request body on POST -14. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -15. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json -16. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json -17. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -18. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -19. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json -20. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json -21. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json -22. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json -23. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json -24. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -25. `13EE` MUST allow string {query} parameter when accepting application/json -26. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -27. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -28. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -29. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -30. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json -31. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json -32. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json -33. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json -34. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -35. `B8B3` MUST allow string {operationName} parameter when accepting application/json -36. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -37. `0220` MUST allow null {variables} parameter when accepting application/json -38. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -39. `0221` MUST allow null {operationName} parameter when accepting application/json -40. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -41. `0222` MUST allow null {extensions} parameter when accepting application/json -42. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -43. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -44. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -45. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json -46. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json -47. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json -48. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json -49. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json -50. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -51. `28B9` MUST allow map {variables} parameter when accepting application/json -52. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -53. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json -54. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json -55. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json -56. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json -57. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json -58. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json -59. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json -60. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json -61. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json -62. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -63. `1B7A` MUST allow map {extensions} parameter when accepting application/json -64. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json -65. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -66. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -67. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -68. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -69. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -70. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -71. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -72. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -73. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -74. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -75. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +

    Passing

    +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 4655 MUST accept application/json and match the content-type
      3. +
    3. 47DE SHOULD accept */* and use application/json for the content-type
      4. +
    4. 80D8 SHOULD assume application/json content-type when accept is missing
      5. +
    5. 82A3 MUST use utf-8 encoding when responding
      6. +
    6. BF61 MUST accept utf-8 encoded request
      7. +
    7. 78D5 MUST assume utf-8 in request if encoding is unspecified
      8. +
    8. 2C94 MUST accept POST requests
      9. +
    9. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      10. +
    10. 9C48 MAY NOT allow executing mutations on GET requests
      11. +
    11. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      12. +
    12. 03D4 MUST accept application/json POST requests
      13. +
    13. 7267 MUST require a request body on POST
      14. +
    14. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      15. +
    15. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
      16. +
    16. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
      17. +
    17. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      18. +
    18. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      19. +
    19. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
      20. +
    20. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
      21. +
    21. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
      22. +
    22. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
      23. +
    23. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
      24. +
    24. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      25. +
    25. 13EE MUST allow string {query} parameter when accepting application/json
      26. +
    26. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      27. +
    27. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      28. +
    28. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      29. +
    29. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      30. +
    30. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
      31. +
    31. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
      32. +
    32. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
      33. +
    33. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
      34. +
    34. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      35. +
    35. B8B3 MUST allow string {operationName} parameter when accepting application/json
      36. +
    36. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      37. +
    37. 0220 MUST allow null {variables} parameter when accepting application/json
      38. +
    38. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      39. +
    39. 0221 MUST allow null {operationName} parameter when accepting application/json
      40. +
    40. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      41. +
    41. 0222 MUST allow null {extensions} parameter when accepting application/json
      42. +
    42. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      43. +
    43. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      44. +
    44. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      45. +
    45. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
      46. +
    46. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
      47. +
    47. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
      48. +
    48. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
      49. +
    49. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
      50. +
    50. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      51. +
    51. 28B9 MUST allow map {variables} parameter when accepting application/json
      52. +
    52. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      53. +
    53. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      54. +
    54. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
      55. +
    55. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      56. +
    56. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      57. +
    57. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      58. +
    58. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      59. +
    59. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      60. +
    60. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      61. +
    61. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      62. +
    62. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      63. +
    63. 1B7A MUST allow map {extensions} parameter when accepting application/json
      64. +
    64. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json
      65. +
    65. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      66. +
    66. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      67. +
    67. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      68. +
    68. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      69. +
    69. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      70. +
    70. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      71. +
    71. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      72. +
    72. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      73. +
    73. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      74. +
    74. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      75. +
    75. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      76. +
    -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
    - -
    - Response status code is not 200 - - ```json +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "57",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "57",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "path": [],
-              "message": "Unable to parse JSON"
-            }
-          ]
-        }
+        "path": [],
+        "message": "Unable to parse JSON"
       }
-      ```
-
      - - 2. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      2. +
    2. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "95",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "95",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "path": [],
-              "message": "Operation of this type is not allowed and has been blocked"
-            }
-          ]
-        }
+        "path": [],
+        "message": "Operation of this type is not allowed and has been blocked"
       }
-      ```
-
      - - 3. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json + ] + } +} + +
      +
      3. +
    3. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "95",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
       {
-        "statusText": "Bad Request",
-        "status": 400,
-        "headers": {
-          "date": "",
-          "content-type": "application/json; charset=utf-8",
-          "content-length": "95",
-          "connection": "close"
-        },
-        "body": {
-          "errors": [
-            {
-              "path": [],
-              "message": "Operation of this type is not allowed and has been blocked"
-            }
-          ]
-        }
+        "path": [],
+        "message": "Operation of this type is not allowed and has been blocked"
       }
-      ```
-
      - + ] + } +} + +
    + + diff --git a/implementations/postgraphile/README.md b/implementations/postgraphile/README.md index 267c6813..53c0ba0b 100644 --- a/implementations/postgraphile/README.md +++ b/implementations/postgraphile/README.md @@ -1,891 +1,797 @@ -_* This report was auto-generated by graphql-http_ - -# GraphQL over HTTP audit report - -- **78** audits in total -- ✅ **45** pass -- ⚠️ **33** warnings (optional) - -## Passing -1. `4655` MUST accept application/json and match the content-type -2. `47DE` SHOULD accept \*/\* and use application/json for the content-type -3. `82A3` MUST use utf-8 encoding when responding -4. `BF61` MUST accept utf-8 encoded request -5. `78D5` MUST assume utf-8 in request if encoding is unspecified -6. `2C94` MUST accept POST requests -7. `9C48` MAY NOT allow executing mutations on GET requests -8. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -9. `03D4` MUST accept application/json POST requests -10. `7267` MUST require a request body on POST -11. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json -12. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json -13. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json -14. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json -15. `13EE` MUST allow string {query} parameter when accepting application/json -16. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json -17. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json -18. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json -19. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json -20. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json -21. `B8B3` MUST allow string {operationName} parameter when accepting application/json -22. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json -23. `0220` MUST allow null {variables} parameter when accepting application/json -24. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json -25. `0221` MUST allow null {operationName} parameter when accepting application/json -26. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -27. `0222` MUST allow null {extensions} parameter when accepting application/json -28. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json -29. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json -30. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json -31. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json -32. `28B9` MUST allow map {variables} parameter when accepting application/json -33. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json -34. `1B7A` MUST allow map {extensions} parameter when accepting application/json -35. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -36. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json -37. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -38. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json -39. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json -40. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -41. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json -42. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json -43. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json -44. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json -45. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json - -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `22EB` SHOULD accept application/graphql-response+json and match the content-type
    - -
    - Response header content-type does not contain application/graphql-response+json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 2. `80D8` SHOULD assume application/json content-type when accept is missing
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Method Not Allowed", - "status": 405, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "60", - "connection": "close", - "allow": "POST, OPTIONS" - }, - "body": { - "errors": [ - { - "message": "Only `POST` requests are allowed." - } - ] - } - } - ``` -
    - - 3. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Method Not Allowed", - "status": 405, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "60", - "connection": "close", - "allow": "POST, OPTIONS" - }, - "body": { - "errors": [ - { - "message": "Only `POST` requests are allowed." - } - ] - } - } - ``` -
    - - 4. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "55", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide a query string." - } - ] - } - } - ``` -
    - - 5. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Internal Server Error", - "status": 500, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "77", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Body must be a string. Received: { obj: \"ect\" }." - } - ] - } - } - ``` -
    - - 6. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Internal Server Error", - "status": 500, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "152", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "The \"data\" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received an instance of Array" - } - ] - } - } - ``` -
    - - 7. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Internal Server Error", - "status": 500, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "77", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Body must be a string. Received: { obj: \"ect\" }." - } - ] - } - } - ``` -
    - - 8. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "55", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide a query string." - } - ] - } - } - ``` -
    - - 9. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "55", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide a query string." - } - ] - } - } - ``` -
    - - 10. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Internal Server Error", - "status": 500, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "152", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "The \"data\" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received an instance of Array" - } - ] - } - } - ``` -
    - - 11. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Operation name must be a string, not 'object'." - } - ] - } - } - ``` -
    - - 12. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Operation name must be a string, not 'number'." - } - ] - } - } - ``` -
    - - 13. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "74", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Operation name must be a string, not 'boolean'." - } - ] - } - } - ``` -
    - - 14. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "73", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Operation name must be a string, not 'object'." - } - ] - } - } - ``` -
    - - 15. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
    - - 16. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "67", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Unexpected token s in JSON at position 0" - } - ] - } - } - ``` -
    - - 17. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "69", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Variables must be an object, not 'number'." - } - ] - } - } - ``` -
    - - 18. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "70", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Variables must be an object, not 'boolean'." - } - ] - } - } - ``` -
    - - 19. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
    - -
    - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
    - - 20. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Method Not Allowed", - "status": 405, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "60", - "connection": "close", - "allow": "POST, OPTIONS" - }, - "body": { - "errors": [ - { - "message": "Only `POST` requests are allowed." - } - ] - } - } - ``` -
    - - 21. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Method Not Allowed", - "status": 405, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "60", - "connection": "close", - "allow": "POST, OPTIONS" - }, - "body": { - "errors": [ - { - "message": "Only `POST` requests are allowed." - } - ] - } - } - ``` -
    - - 22. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" +* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 78 audits in total
      • +
    • ✅ 45 pass
      • +
    • ⚠️ 33 warnings (optional)
      • +
    + +

    Passing

    +
      +
    1. 4655 MUST accept application/json and match the content-type
      2. +
    2. 47DE SHOULD accept */* and use application/json for the content-type
      3. +
    3. 82A3 MUST use utf-8 encoding when responding
      4. +
    4. BF61 MUST accept utf-8 encoded request
      5. +
    5. 78D5 MUST assume utf-8 in request if encoding is unspecified
      6. +
    6. 2C94 MUST accept POST requests
      7. +
    7. 9C48 MAY NOT allow executing mutations on GET requests
      8. +
    8. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      9. +
    9. 03D4 MUST accept application/json POST requests
      10. +
    10. 7267 MUST require a request body on POST
      11. +
    11. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
      12. +
    12. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
      13. +
    13. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
      14. +
    14. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      15. +
    15. 13EE MUST allow string {query} parameter when accepting application/json
      16. +
    16. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
      17. +
    17. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
      18. +
    18. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
      19. +
    19. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
      20. +
    20. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      21. +
    21. B8B3 MUST allow string {operationName} parameter when accepting application/json
      22. +
    22. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      23. +
    23. 0220 MUST allow null {variables} parameter when accepting application/json
      24. +
    24. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      25. +
    25. 0221 MUST allow null {operationName} parameter when accepting application/json
      26. +
    26. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      27. +
    27. 0222 MUST allow null {extensions} parameter when accepting application/json
      28. +
    28. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
      29. +
    29. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
      30. +
    30. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
      31. +
    31. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      32. +
    32. 28B9 MUST allow map {variables} parameter when accepting application/json
      33. +
    33. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      34. +
    34. 1B7A MUST allow map {extensions} parameter when accepting application/json
      35. +
    35. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      36. +
    36. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
      37. +
    37. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      38. +
    38. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
      39. +
    39. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
      40. +
    40. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      41. +
    41. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      42. +
    42. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      43. +
    43. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      44. +
    44. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      45. +
    45. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      46. +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      +Response header content-type does not contain application/graphql-response+json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      2. +
    2. 80D8 SHOULD assume application/json content-type when accept is missing +
      +Response status code is not 200 +
      {
+  "statusText": "Method Not Allowed",
+  "status": 405,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "60",
+    "connection": "close",
+    "allow": "POST, OPTIONS"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Only `POST` requests are allowed."
+      }
+    ]
+  }
+}
+
      +
      +
      3. +
    3. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests +
      +Response status code is not 200 +
      {
+  "statusText": "Method Not Allowed",
+  "status": 405,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "60",
+    "connection": "close",
+    "allow": "POST, OPTIONS"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Only `POST` requests are allowed."
+      }
+    ]
+  }
+}
+
      +
      +
      4. +
    4. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "55",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide a query string."
+      }
+    ]
+  }
+}
+
      +
      +
      5. +
    5. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Internal Server Error",
+  "status": 500,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "77",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Body must be a string. Received: { obj: \"ect\" }."
+      }
+    ]
+  }
+}
+
      +
      +
      6. +
    6. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Internal Server Error",
+  "status": 500,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "152",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "The \"data\" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received an instance of Array"
+      }
+    ]
+  }
+}
+
      +
      +
      7. +
    7. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Internal Server Error",
+  "status": 500,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "77",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Body must be a string. Received: { obj: \"ect\" }."
+      }
+    ]
+  }
+}
+
      +
      +
      8. +
    8. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "55",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide a query string."
+      }
+    ]
+  }
+}
+
      +
      +
      9. +
    9. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "55",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide a query string."
+      }
+    ]
+  }
+}
+
      +
      +
      10. +
    10. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Internal Server Error",
+  "status": 500,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "152",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "The \"data\" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received an instance of Array"
+      }
+    ]
+  }
+}
+
      +
      +
      11. +
    11. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Operation name must be a string, not 'object'."
+      }
+    ]
+  }
+}
+
      +
      +
      12. +
    12. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Operation name must be a string, not 'number'."
+      }
+    ]
+  }
+}
+
      +
      +
      13. +
    13. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "74",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Operation name must be a string, not 'boolean'."
+      }
+    ]
+  }
+}
+
      +
      +
      14. +
    14. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "73",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Operation name must be a string, not 'object'."
+      }
+    ]
+  }
+}
+
      +
      +
      15. +
    15. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      16. +
    16. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "67",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Unexpected token s in JSON at position 0"
+      }
+    ]
+  }
+}
+
      +
      +
      17. +
    17. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Variables must be an object, not 'number'."
+      }
+    ]
+  }
+}
+
      +
      +
      18. +
    18. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "70",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Variables must be an object, not 'boolean'."
+      }
+    ]
+  }
+}
+
      +
      +
      19. +
    19. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      20. +
    20. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Method Not Allowed",
+  "status": 405,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "60",
+    "connection": "close",
+    "allow": "POST, OPTIONS"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Only `POST` requests are allowed."
+      }
+    ]
+  }
+}
+
      +
      +
      21. +
    21. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Method Not Allowed",
+  "status": 405,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "60",
+    "connection": "close",
+    "allow": "POST, OPTIONS"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Only `POST` requests are allowed."
+      }
+    ]
+  }
+}
+
      +
      +
      22. +
    22. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      23. +
    23. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      24. +
    24. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      25. +
    25. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
      +
      +
      26. +
    26. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      27. +
    27. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      28. +
    28. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      29. +
    29. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response body execution result does not have a property "errors" +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "close"
+  },
+  "body": null
+}
+
      +
      +
      30. +
    30. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "55",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Unexpected end of JSON input"
+      }
+    ]
+  }
+}
+
      +
      +
      31. +
    31. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "55",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Must provide a query string."
+      }
+    ]
+  }
+}
+
      +
      +
      32. +
    32. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "104",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
           }
-        }
-      }
-      ```
-
      - - 23. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
      - - 24. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" - } - } - } - ``` -
      - - 25. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
      - -
      - Response status code is not 400 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": { - "data": { - "__typename": "Query" + ] + } + ] + } +} + +
      +
      33. +
    33. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "123",
+    "connection": "close"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
           }
-        }
-      }
-      ```
-
      - - 26. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 27. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 28. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 29. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
      - -
      - Response body execution result does not have a property "errors" - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "31", - "connection": "close" - }, - "body": null - } - ``` -
      - - 30. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "55", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Unexpected end of JSON input" - } - ] - } - } - ``` -
      - - 31. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "55", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Must provide a query string." - } - ] - } - } - ``` -
      - - 32. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "104", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Expected Name, found .", - "locations": [ - { - "line": 1, - "column": 2 - } - ] - } - ] - } - } - ``` -
      - - 33. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
      - -
      - Response status code is not 200 - - ```json - { - "statusText": "Bad Request", - "status": 400, - "headers": { - "date": "", - "content-type": "application/json; charset=utf-8", - "content-length": "123", - "connection": "close" - }, - "body": { - "errors": [ - { - "message": "Syntax Error: Invalid number, expected digit but got: \"f\".", - "locations": [ - { - "line": 1, - "column": 4 - } - ] - } - ] - } - } - ``` -
      - + ] + } + ] + } +} +       +
    + + diff --git a/implementations/thegraph/README.md b/implementations/thegraph/README.md index 38d8495c..253fbb8b 100644 --- a/implementations/thegraph/README.md +++ b/implementations/thegraph/README.md @@ -1,1945 +1,1738 @@ -_* This report was auto-generated by graphql-http_ - -# GraphQL over HTTP audit report - -- **78** audits in total -- ✅ **7** pass -- ⚠️ **57** warnings (optional) -- ❌ **14** errors (required) - -## Passing -1. `5A70` MAY accept application/x-www-form-urlencoded formatted GET requests -2. `9ABE` SHOULD respond with 4xx status code if content-type is not supplied on POST requests -3. `D6D5` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json -4. `60AA` SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json -5. `3E36` SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json -6. `865D` SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json -7. `51FE` SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json - -## Warnings -The server _SHOULD_ support these, but is not required. - - 1. `22EB` SHOULD accept application/graphql-response+json and match the content-type
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 2. `47DE` SHOULD accept \*/\* and use application/json for the content-type
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 3. `80D8` SHOULD assume application/json content-type when accept is missing
    - -
    - Response header content-type does not contain application/json - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "transfer-encoding": "chunked", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/html", - "content-encoding": "br", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "" - } - ``` -
    - - 4. `9C48` MAY NOT allow executing mutations on GET requests
    - -
    - Response status is not between 400 and 499 - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "transfer-encoding": "chunked", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/html", - "content-encoding": "br", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "" - } - ``` -
    - - 5. `6610` SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 6. `3715` SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 7. `4F50` SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 8. `4F51` SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 9. `4F52` SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 10. `4F53` SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 11. `9FE0` SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 12. `9FE1` SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 13. `9FE2` SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 14. `9FE3` SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 15. `34A2` SHOULD allow string {query} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 16. `E3E0` SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 17. `E3E1` SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 18. `E3E2` SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 19. `E3E3` SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 20. `FB90` SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 21. `FB91` SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 22. `FB92` SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 23. `FB93` SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 24. `8161` SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 25. `94B0` SHOULD allow null {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 26. `94B1` SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 27. `94B2` SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 28. `69B0` SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 29. `69B1` SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 30. `69B2` SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 31. `69B3` SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 32. `F050` SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 33. `F051` SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 34. `F052` SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 35. `F053` SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 36. `2EA1` SHOULD allow map {variables} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 37. `6A70` MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "OK", - "status": 200, - "headers": { - "vary": "Accept-Encoding", - "transfer-encoding": "chunked", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/html", - "content-encoding": "br", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": null - } - ``` -
    - - 38. `9040` SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 39. `9041` SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 40. `9042` SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 41. `9043` SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 42. `3680` SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 43. `3681` SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 44. `3682` SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 45. `3683` SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 46. `428F` SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 47. `D477` SHOULD use 200 status code on JSON parsing failure when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 48. `F5AF` SHOULD use 200 status code if parameters are invalid when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 49. `572B` SHOULD use 200 status code on document parsing failure when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 50. `FDE2` SHOULD use 200 status code on document validation failure when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 51. `2163` SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 52. `17C5` SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 53. `34D6` SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": null - } - ``` -
    - - 54. `556A` SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 55. `D586` SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": null - } - ``` -
    - - 56. `74FF` SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 57. `5E5B` SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
    - -
    - Response body is not valid JSON - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": null - } - ``` -
    - - -## Errors -The server _MUST_ support these. - - 1. `4655` MUST accept application/json and match the content-type
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 2. `82A3` MUST use utf-8 encoding when responding
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 3. `BF61` MUST accept utf-8 encoded request
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 4. `78D5` MUST assume utf-8 in request if encoding is unspecified
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 5. `2C94` MUST accept POST requests
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 6. `03D4` MUST accept application/json POST requests
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 7. `7267` MUST require a request body on POST
    - -
    - Response status code is not 400 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 8. `13EE` MUST allow string {query} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 9. `B8B3` MUST allow string {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 10. `0220` MUST allow null {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 11. `0221` MUST allow null {operationName} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 12. `0222` MUST allow null {extensions} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 13. `28B9` MUST allow map {variables} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - - 14. `1B7A` MUST allow map {extensions} parameter when accepting application/json
    - -
    - Response status code is not 200 - - ```json - { - "statusText": "Not Found", - "status": 404, - "headers": { - "vary": "Accept-Encoding", - "strict-transport-security": "max-age=15724800; includeSubDomains", - "server-timing": "", - "server": "cloudflare", - "date": "", - "content-type": "text/plain", - "content-length": "9", - "connection": "close", - "cf-ray": "", - "cf-cache-status": "DYNAMIC", - "access-control-allow-origin": "*" - }, - "body": "Not found" - } - ``` -
    - +* This report was auto-generated by graphql-http + +

    GraphQL over HTTP audit report

    + +
      +
    • 78 audits in total
      • +
    • ✅ 7 pass
      • +
    • ⚠️ 57 warnings (optional)
      • +
    • ❌ 14 errors (required)
      • +
    + +

    Passing

    +
      +
    1. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      2. +
    2. 9ABE SHOULD respond with 4xx status code if content-type is not supplied on POST requests
      3. +
    3. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      4. +
    4. 60AA SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
      5. +
    5. 3E36 SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
      6. +
    6. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      7. +
    7. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      8. +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      2. +
    2. 47DE SHOULD accept */* and use application/json for the content-type +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      3. +
    3. 80D8 SHOULD assume application/json content-type when accept is missing +
      +Response header content-type does not contain application/json +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/html",
+    "content-encoding": "br",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": ""
+}
+
      +
      +
      4. +
    4. 9C48 MAY NOT allow executing mutations on GET requests +
      +Response status is not between 400 and 499 +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/html",
+    "content-encoding": "br",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": ""
+}
+
      +
      +
      5. +
    5. 6610 SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      6. +
    6. 3715 SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      7. +
    7. 4F50 SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      8. +
    8. 4F51 SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      9. +
    9. 4F52 SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      10. +
    10. 4F53 SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      11. +
    11. 9FE0 SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      12. +
    12. 9FE1 SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      13. +
    13. 9FE2 SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      14. +
    14. 9FE3 SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      15. +
    15. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      16. +
    16. E3E0 SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      17. +
    17. E3E1 SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      18. +
    18. E3E2 SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      19. +
    19. E3E3 SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      20. +
    20. FB90 SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      21. +
    21. FB91 SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      22. +
    22. FB92 SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      23. +
    23. FB93 SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      24. +
    24. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      25. +
    25. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      26. +
    26. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      27. +
    27. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      28. +
    28. 69B0 SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      29. +
    29. 69B1 SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      30. +
    30. 69B2 SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      31. +
    31. 69B3 SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      32. +
    32. F050 SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      33. +
    33. F051 SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      34. +
    34. F052 SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      35. +
    35. F053 SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      36. +
    36. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      37. +
    37. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json +
      +Response body is not valid JSON +
      {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/html",
+    "content-encoding": "br",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": null
+}
+
      +
      +
      38. +
    38. 9040 SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      39. +
    39. 9041 SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      40. +
    40. 9042 SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      41. +
    41. 9043 SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      42. +
    42. 3680 SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      43. +
    43. 3681 SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      44. +
    44. 3682 SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      45. +
    45. 3683 SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      46. +
    46. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      47. +
    47. D477 SHOULD use 200 status code on JSON parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      48. +
    48. F5AF SHOULD use 200 status code if parameters are invalid when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      49. +
    49. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      50. +
    50. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      51. +
    51. 2163 SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      52. +
    52. 17C5 SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      53. +
    53. 34D6 SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json +
      +Response body is not valid JSON +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": null
+}
+
      +
      +
      54. +
    54. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      55. +
    55. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json +
      +Response body is not valid JSON +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": null
+}
+
      +
      +
      56. +
    56. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      57. +
    57. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +
      +Response body is not valid JSON +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": null
+}
+
      +
      +
      58. +
    + +

    Errors

    +The server MUST support these. +
      +
    1. 4655 MUST accept application/json and match the content-type +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      2. +
    2. 82A3 MUST use utf-8 encoding when responding +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      3. +
    3. BF61 MUST accept utf-8 encoded request +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      4. +
    4. 78D5 MUST assume utf-8 in request if encoding is unspecified +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      5. +
    5. 2C94 MUST accept POST requests +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      6. +
    6. 03D4 MUST accept application/json POST requests +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      7. +
    7. 7267 MUST require a request body on POST +
      +Response status code is not 400 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      8. +
    8. 13EE MUST allow string {query} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      9. +
    9. B8B3 MUST allow string {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      10. +
    10. 0220 MUST allow null {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      11. +
    11. 0221 MUST allow null {operationName} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      12. +
    12. 0222 MUST allow null {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      13. +
    13. 28B9 MUST allow map {variables} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      14. +
    14. 1B7A MUST allow map {extensions} parameter when accepting application/json +
      +Response status code is not 200 +
      {
+  "statusText": "Not Found",
+  "status": 404,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "strict-transport-security": "max-age=15724800; includeSubDomains",
+    "server-timing": "",
+    "server": "cloudflare",
+    "date": "",
+    "content-type": "text/plain",
+    "content-length": "9",
+    "connection": "close",
+    "cf-ray": "",
+    "cf-cache-status": "DYNAMIC",
+    "access-control-allow-origin": "*"
+  },
+  "body": "Not found"
+}
+
      +
      +
      15. +
    From 934aa6c10742ea4d849dc2c516a737765c974e05 Mon Sep 17 00:00:00 2001 From: enisdenjo Date: Sun, 12 Feb 2023 21:20:02 +0100 Subject: [PATCH 6/6] unnecessary type imports --- scripts/audit-implementation.mjs | 6 ------ 1 file changed, 6 deletions(-) diff --git a/scripts/audit-implementation.mjs b/scripts/audit-implementation.mjs index 1c1b0f89..5c4d362c 100644 --- a/scripts/audit-implementation.mjs +++ b/scripts/audit-implementation.mjs @@ -21,12 +21,6 @@ import fs from 'fs/promises'; import path from 'path'; import { auditServer, renderAuditResultsToHTML } from '../lib/index.mjs'; -/** - * @typedef { import("../src/audits").AuditResult } AuditResult - * @typedef { import("../src/audits").AuditOk } AuditOk - * @typedef { import("../src/audits").AuditFail } AuditFail - */ - async function main() { const serverUrl = new URL( process.env.URL || `http://localhost:${process.env.PORT}/graphql`,