|
| 1 | +_* This report was auto-generated by graphql-http_ |
| 2 | + |
| 3 | +# GraphQL over HTTP audit report |
| 4 | + |
| 5 | +- **73** audits in total |
| 6 | +- ✅ **44** pass |
| 7 | +- ⚠️ **29** warnings (optional) |
| 8 | + |
| 9 | +## Passing |
| 10 | +1. MUST accept application/json and match the content-type |
| 11 | +2. MUST use utf-8 encoding when responding |
| 12 | +3. MUST accept utf-8 encoding |
| 13 | +4. MUST assume utf-8 if encoding is unspecified |
| 14 | +5. MUST accept POST requests |
| 15 | +6. MAY accept application/x-www-form-urlencoded formatted GET requests |
| 16 | +7. MUST NOT allow executing mutations on GET requests |
| 17 | +8. SHOULD respond with 4xx status code if content-type is not supplied on POST requests |
| 18 | +9. MUST accept application/json POST requests |
| 19 | +10. MUST require a request body on POST |
| 20 | +11. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json |
| 21 | +12. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json |
| 22 | +13. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json |
| 23 | +14. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json |
| 24 | +15. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json |
| 25 | +16. SHOULD allow string {query} parameter when accepting application/graphql-response+json |
| 26 | +17. MUST allow string {query} parameter when accepting application/json |
| 27 | +18. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json |
| 28 | +19. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json |
| 29 | +20. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json |
| 30 | +21. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json |
| 31 | +22. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json |
| 32 | +23. MUST allow string {operationName} parameter when accepting application/json |
| 33 | +24. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json |
| 34 | +25. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json |
| 35 | +26. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json |
| 36 | +27. SHOULD allow map {variables} parameter when accepting application/graphql-response+json |
| 37 | +28. MUST allow map {variables} parameter when accepting application/json |
| 38 | +29. SHOULD allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json |
| 39 | +30. MUST allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json |
| 40 | +31. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json |
| 41 | +32. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json |
| 42 | +33. MUST allow map {extensions} parameter when accepting application/json |
| 43 | +34. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json |
| 44 | +35. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json |
| 45 | +36. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json |
| 46 | +37. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json |
| 47 | +38. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json |
| 48 | +39. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json |
| 49 | +40. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json |
| 50 | +41. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json |
| 51 | +42. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json |
| 52 | +43. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json |
| 53 | +44. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json |
| 54 | + |
| 55 | +## Warnings |
| 56 | +The server _SHOULD_ support these, but is not required. |
| 57 | +1. SHOULD accept application/graphql-response+json and match the content-type<br /> |
| 58 | +``` |
| 59 | +Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json" |
| 60 | +``` |
| 61 | +2. SHOULD accept \*/\* and use application/graphql-response+json for the content-type<br /> |
| 62 | +``` |
| 63 | +Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json" |
| 64 | +``` |
| 65 | +3. SHOULD assume application/graphql-response+json content-type when accept is missing<br /> |
| 66 | +``` |
| 67 | +Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json" |
| 68 | +``` |
| 69 | +4. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json<br /> |
| 70 | +``` |
| 71 | +Status code 400 is not 200 |
| 72 | +``` |
| 73 | +5. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json<br /> |
| 74 | +``` |
| 75 | +Status code 400 is not 200 |
| 76 | +``` |
| 77 | +6. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json<br /> |
| 78 | +``` |
| 79 | +Status code 400 is not 200 |
| 80 | +``` |
| 81 | +7. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json<br /> |
| 82 | +``` |
| 83 | +Status code 400 is not 200 |
| 84 | +``` |
| 85 | +8. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json<br /> |
| 86 | +``` |
| 87 | +Status code 400 is not 200 |
| 88 | +``` |
| 89 | +9. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json<br /> |
| 90 | +``` |
| 91 | +Status code 400 is not 200 |
| 92 | +``` |
| 93 | +10. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json<br /> |
| 94 | +``` |
| 95 | +Status code 400 is not 200 |
| 96 | +``` |
| 97 | +11. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json<br /> |
| 98 | +``` |
| 99 | +Status code 400 is not 200 |
| 100 | +``` |
| 101 | +12. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json<br /> |
| 102 | +``` |
| 103 | +Status code 400 is not 200 |
| 104 | +``` |
| 105 | +13. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json<br /> |
| 106 | +``` |
| 107 | +Status code 200 is not 400 |
| 108 | +``` |
| 109 | +14. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json<br /> |
| 110 | +``` |
| 111 | +Status code 400 is not 200 |
| 112 | +``` |
| 113 | +15. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json<br /> |
| 114 | +``` |
| 115 | +Status code 400 is not 200 |
| 116 | +``` |
| 117 | +16. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json<br /> |
| 118 | +``` |
| 119 | +Status code 400 is not 200 |
| 120 | +``` |
| 121 | +17. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json<br /> |
| 122 | +``` |
| 123 | +Execution result {"data":{"__typename":"Query"}} does not have a property 'errors' |
| 124 | +``` |
| 125 | +18. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json<br /> |
| 126 | +``` |
| 127 | +Status code 200 is not 400 |
| 128 | +``` |
| 129 | +19. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json<br /> |
| 130 | +``` |
| 131 | +Status code 200 is not 400 |
| 132 | +``` |
| 133 | +20. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json<br /> |
| 134 | +``` |
| 135 | +Status code 200 is not 400 |
| 136 | +``` |
| 137 | +21. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json<br /> |
| 138 | +``` |
| 139 | +Status code 400 is not 200 |
| 140 | +``` |
| 141 | +22. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json<br /> |
| 142 | +``` |
| 143 | +Execution result {"data":{"__typename":"Query"}} does not have a property 'errors' |
| 144 | +``` |
| 145 | +23. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json<br /> |
| 146 | +``` |
| 147 | +Execution result {"data":{"__typename":"Query"}} does not have a property 'errors' |
| 148 | +``` |
| 149 | +24. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json<br /> |
| 150 | +``` |
| 151 | +Execution result {"data":{"__typename":"Query"}} does not have a property 'errors' |
| 152 | +``` |
| 153 | +25. SHOULD use 200 status code on JSON parsing failure when accepting application/json<br /> |
| 154 | +``` |
| 155 | +Status code 400 is not 200 |
| 156 | +``` |
| 157 | +26. SHOULD use 200 status code if parameters are invalid when accepting application/json<br /> |
| 158 | +``` |
| 159 | +Status code 400 is not 200 |
| 160 | +``` |
| 161 | +27. SHOULD use 200 status code on document parsing failure when accepting application/json<br /> |
| 162 | +``` |
| 163 | +Status code 400 is not 200 |
| 164 | +``` |
| 165 | +28. SHOULD use 200 status code on document validation failure when accepting application/json<br /> |
| 166 | +``` |
| 167 | +Status code 400 is not 200 |
| 168 | +``` |
| 169 | +29. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json<br /> |
| 170 | +``` |
| 171 | +Response body is not valid JSON. Got "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>SyntaxError: Unexpected end of JSON input<br> at JSON.parse (<anonymous>)<br> at parse (/home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/types/json.js:89:19)<br> at /home/runner/work/graphql-http/graphql-http/node_modules/body-parser/lib/read.js:128:18<br> at AsyncResource.runInAsyncScope (node:async_hooks:203:9)<br> at invokeCallback (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:231:16)<br> at done (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:220:7)<br> at IncomingMessage.onEnd (/home/runner/work/graphql-http/graphql-http/node_modules/raw-body/index.js:280:7)<br> at IncomingMessage.emit (node:events:513:28)<br> at endReadableNT (node:internal/streams/rea... |
| 172 | +``` |
| 173 | + |
0 commit comments