> [!WARNING] > Is not tested automatically by the CI anymore. > See [#121](https://github.com/graphql/graphql-http/pull/121) * This report was auto-generated by graphql-http

GraphQL over HTTP audit report

Passing

  1. 22EB SHOULD accept application/graphql-response+json and match the content-type
  2. 4655 MUST accept application/json and match the content-type
  3. 47DE SHOULD accept */* and use application/json for the content-type
  4. 80D8 SHOULD assume application/json content-type when accept is missing
  5. 82A3 MUST use utf-8 encoding when responding
  6. BF61 MUST accept utf-8 encoded request
  7. 78D5 MUST assume utf-8 in request if encoding is unspecified
  8. 2C94 MUST accept POST requests
  9. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
  10. 9C48 MAY NOT allow executing mutations on GET requests
  11. 9ABE MAY respond with 4xx status code if content-type is not supplied on POST requests
  12. 03D4 MUST accept application/json POST requests
  13. A5BF MAY use 400 status code when request body is missing on POST
  14. 423L MAY use 400 status code on missing {query} parameter
  15. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
  16. 13EE MUST allow string {query} parameter when accepting application/json
  17. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
  18. B8B3 MUST allow string {operationName} parameter when accepting application/json
  19. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
  20. 0220 MUST allow null {variables} parameter when accepting application/json
  21. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
  22. 0221 MUST allow null {operationName} parameter when accepting application/json
  23. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
  24. 0222 MUST allow null {extensions} parameter when accepting application/json
  25. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
  26. 28B9 MUST allow map {variables} parameter when accepting application/json
  27. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
  28. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
  29. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
  30. 1B7A MUST allow map {extensions} parameter when accepting application/json
  31. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
  32. BCF8 MAY use 400 status code on JSON parsing failure
  33. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
  34. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
  35. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
  36. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
  37. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
  38. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
  39. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json

Notices

The server MAY support these, but are truly optional. These are suggestions following recommended conventions.
  1. LKJ0 MAY use 400 status code on object {query} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  2. LKJ1 MAY use 400 status code on number {query} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  3. LKJ2 MAY use 400 status code on boolean {query} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  4. LKJ3 MAY use 400 status code on array {query} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  5. 6C00 MAY use 400 status code on object {operationName} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  6. 6C01 MAY use 400 status code on number {operationName} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  7. 6C02 MAY use 400 status code on boolean {operationName} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  8. 6C03 MAY use 400 status code on array {operationName} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  9. 4760 MAY use 400 status code on string {variables} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  10. 4761 MAY use 400 status code on number {variables} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  11. 4762 MAY use 400 status code on boolean {variables} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  12. 4763 MAY use 400 status code on array {variables} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  13. 58B0 MAY use 400 status code on string {extensions} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  14. 58B1 MAY use 400 status code on number {extensions} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  15. 58B2 MAY use 400 status code on boolean {extensions} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  16. 58B3 MAY use 400 status code on array {extensions} parameter
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "65",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Invalid GraphQL request form"
      }
    ]
  }
}
  17. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
    Response status is not between 400 and 599 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "60",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Missing query parameter"
      }
    ]
  }
}
  18. 3E3A MAY use 400 status code if parameters are invalid
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "60",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Missing query parameter"
      }
    ]
  }
}

Warnings

The server SHOULD support these, but is not required.
  1. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
    Response status code is not 200 
    {
  "statusText": "Bad Request",
  "status": 400,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "95",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Operation of this type is not allowed and has been blocked"
      }
    ]
  }
}
  2. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
    Response status code is not 200 
    {
  "statusText": "Bad Request",
  "status": 400,
  "headers": {
    "date": "",
    "content-type": "application/json; charset=utf-8",
    "content-length": "95",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Operation of this type is not allowed and has been blocked"
      }
    ]
  }
}
  3. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
    Response status code is not 400 
    {
  "statusText": "OK",
  "status": 200,
  "headers": {
    "date": "",
    "content-type": "application/graphql-response+json; charset=utf-8, application/graphql-response+json",
    "content-length": "136",
    "connection": "keep-alive"
  },
  "body": {
    "errors": [
      {
        "path": [],
        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
        "locations": [
          {
            "line": 1,
            "column": 21
          }
        ]
      }
    ]
  }
}