Feature add allow batched http requests flag

CHANGELOG.md

@@ -12,6 +12,7 @@ The version headers in this history reflect the versions of Apollo Server itself
 - `apollo-server-core`: Fix build error when building with `@rollup/plugin-commonjs`. [PR #5797](https://github.com/apollographql/apollo-server/pull/5797)
 - `apollo-server-plugin-response-cache`: Add missing dependency on `apollo-server-types` (broken since v3.0.0). [Issue #5804](https://github.com/apollographql/apollo-server/issues/5804) [PR #5816](https://github.com/apollographql/apollo-server/pull/5816)
 - `apollo-server-core`: The default landing page plugins now take `document`, `variables`, and `headers` arguments which fill in default values if you click through to Explorer. [PR #5711](https://github.com/apollographql/apollo-server/pull/5711)
+- `apollo-server-core`: Support for HTTP request batching can now be disabled by passing `allowBatchedHttpRequests: false` to `new ApolloServer`. [PR #5778](https://github.com/apollographql/apollo-server/pull/5778) [Issue #5686](https://github.com/apollographql/apollo-server/issues/5686)
 
 ## v3.4.0
 

docs/source/api/apollo-server.mdx

@@ -284,6 +284,19 @@ An object containing configuration options for connecting Apollo Server to [Apol
 </td>
 </tr>
 
+<tr>
+<td>
+
+##### `allowBatchedHttpRequests`
+
+`Boolean`
+</td>
+<td>
+
+Controls whether to allow [Batching Queries](../requests/#batching) in a single HTTP Request. Defaults to `true`. If the GraphQL Server has this flag set to `false` and a request comes in with more than one query, an error will be thrown.
+</td>
+</tr>
+
 
 <tr>
 <td colspan="2">

docs/source/requests.md

@@ -66,6 +66,8 @@ You can send a batch of queries in a single POST request by providing a JSON-enc
 
 If you send a batched request, Apollo Server responds with a corresponding array of GraphQL responses.
 
+Allowing batched requests can be toggled through the `allowBatchedHttpRequests` flag in the Apollo Server Options.
+
 ## GET requests
 
 Apollo Server also accepts GET requests for queries (but not mutations). With a GET request, query details (`query`, `operationName`, `variables`) are provided as URL query parameters. The `variables` option is a URL-escaped JSON object.

packages/apollo-server-core/src/__tests__/runHttpQuery.test.ts

@@ -58,4 +58,95 @@ describe('runHttpQuery', () => {
       });
     });
   });
+
+  describe('when allowBatchedHttpRequests is false', () => {
+    const mockDisabledBatchQueryRequest = {
+      method: 'GET',
+      query: {
+        query: '{ testString }',
+      },
+      options: {
+        debug: false,
+        schema,
+        schemaHash: 'deprecated' as SchemaHash,
+        allowBatchedHttpRequests: false,
+      },
+      request: new MockReq(),
+    };
+
+    it('succeeds when there are no batched queries in the request', async () => {
+      await expect(
+        runHttpQuery([], mockDisabledBatchQueryRequest),
+      ).resolves.not.toThrow();
+    });
+
+    it('throws when there are batched queries in the request', () => {
+      const batchedQueryRequest = Object.assign(
+        {},
+        mockDisabledBatchQueryRequest,
+        {
+          query: [
+            {
+              query: '{ testString }',
+            },
+            {
+              query: '{ testString }',
+            },
+          ],
+        },
+      );
+      return runHttpQuery([], batchedQueryRequest).catch(
+        (err: HttpQueryError) => {
+          expect(err.statusCode).toEqual(400);
+          expect(err.message).toEqual(
+            JSON.stringify({
+              errors: [
+                {
+                  message: 'Operation batching disabled.',
+                  extensions: { code: 'INTERNAL_SERVER_ERROR' },
+                },
+              ],
+            }) + '\n',
+          );
+        },
+      );
+    });
+  });
+
+  describe('when allowBatchedHttpRequests is true', () => {
+    const mockEnabledBatchQueryRequest = {
+      method: 'GET',
+      query: {
+        query: '{ testString }',
+      },
+      options: {
+        debug: false,
+        schema,
+        schemaHash: 'deprecated' as SchemaHash,
+        allowBatchedHttpRequests: true,
+      },
+      request: new MockReq(),
+    };
+
+    it('succeeds when there are multiple queries in the request', async () => {
+      const multipleQueryRequest = Object.assign(
+        {},
+        mockEnabledBatchQueryRequest,
+        {
+          query: [
+            {
+              query: '{ testString }',
+            },
+            {
+              query: '{ testString }',
+            },
+          ],
+        },
+      );
+
+      await expect(
+        runHttpQuery([], multipleQueryRequest),
+      ).resolves.not.toThrow();
+    });
+  });
 });

packages/apollo-server-core/src/graphqlOptions.ts

@@ -33,6 +33,7 @@ import type { DocumentStore } from './types';
  * - (optional) fieldResolver: a custom default field resolver
  * - (optional) debug: a boolean that will print additional debug logging if execution errors occur
  * - (optional) parseOptions: options to pass when parsing schemas and queries
+ * - (optional) allowBatchedHttpRequests: a boolean to toggle whether a single request can contain multiple queries. True by default
  *
  */
 export interface GraphQLServerOptions<
@@ -63,6 +64,7 @@ export interface GraphQLServerOptions<
   documentStore?: DocumentStore | null;
   parseOptions?: ParseOptions;
   nodeEnv?: string;
+  allowBatchedHttpRequests?: boolean;
 }
 
 export type DataSources<TContext> = {

packages/apollo-server-core/src/runHttpQuery.ts

@@ -196,6 +196,8 @@ export async function runHttpQuery(
     debug: options.debug,
 
     plugins: options.plugins || [],
+
+    allowBatchedHttpRequests: options.allowBatchedHttpRequests,
   };
 
   return processHTTPRequest(config, request);
@@ -298,6 +300,14 @@ export async function processHTTPRequest<TContext>(
         parseGraphQLRequest(httpRequest.request, requestParams),
       );
 
+      if (options.allowBatchedHttpRequests === false) {
+        return throwHttpGraphQLError(
+          400,
+          [new Error('Operation batching disabled.')],
+          options,
+        );
+      }
+
       const responses = await Promise.all(
         requests.map(async (request) => {
           try {

packages/apollo-server-core/src/types.ts

@@ -42,6 +42,7 @@ type BaseConfig = Pick<
   | 'dataSources'
   | 'cache'
   | 'logger'
+  | 'allowBatchedHttpRequests'
 >;
 
 export type Unsubscriber = () => void;

packages/apollo-server-integration-testsuite/src/index.ts

@@ -878,6 +878,43 @@ export default ({
         });
       }, 3000); // this test will fail due to timeout if running serially.
 
+      it('disables batch requests when allowBatchedHttpRequests is false', async () => {
+        app = await createApp({
+          graphqlOptions: {
+            schema,
+            allowBatchedHttpRequests: false,
+          },
+        });
+
+        const res = await request(app)
+          .post('/graphql')
+          .send([
+            {
+              query: `
+                      query test($echo: String){ testArgument(echo: $echo) }
+                      query test2{ testString }`,
+              variables: { echo: 'world' },
+              operationName: 'test2',
+            },
+            {
+              query: `
+                      query testX($echo: String){ testArgument(echo: $echo) }`,
+              variables: { echo: 'yellow' },
+              operationName: 'testX',
+            },
+          ]);
+
+        expect(res.status).toEqual(400);
+        expect(res.body).toEqual({
+          errors: [
+            {
+              message: 'Operation batching disabled.',
+              extensions: { code: 'INTERNAL_SERVER_ERROR' },
+            },
+          ],
+        });
+      });
+
       it('clones batch context', async () => {
         app = await createApp({
           graphqlOptions: {