README.md

* This report was auto-generated by graphql-http

GraphQL over HTTP audit report

• 73 audits in total
• ✅ 37 pass
• ⚠️ 36 warnings (optional)

Passing

1. MUST accept application/json and match the content-type
2. MUST use utf-8 encoding when responding
3. MUST accept utf-8 encoding
4. MUST assume utf-8 if encoding is unspecified
5. MUST accept POST requests
6. MAY accept application/x-www-form-urlencoded formatted GET requests
7. MAY NOT allow executing mutations on GET requests
8. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
9. MUST accept application/json POST requests
10. MUST require a request body on POST
11. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
12. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
13. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
14. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
15. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
16. SHOULD allow string {query} parameter when accepting application/graphql-response+json
17. MUST allow string {query} parameter when accepting application/json
18. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
19. MUST allow string {operationName} parameter when accepting application/json
20. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
21. MUST allow map {variables} parameter when accepting application/json
22. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
23. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
24. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
25. MUST allow map {extensions} parameter when accepting application/json
26. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
27. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
28. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
29. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
30. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
31. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
32. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
33. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
34. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
35. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
36. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
37. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json

Warnings

The server SHOULD support these, but is not required.

1. SHOULD accept application/graphql-response+json and match the content-type
   

Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"

2. SHOULD accept */* and use application/graphql-response+json for the content-type
   

Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"

3. SHOULD assume application/graphql-response+json content-type when accept is missing
   

Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"

4. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
   

Status code 400 is not 200

5. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
   

Status code 400 is not 200

6. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
   

Status code 400 is not 200

7. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
   

Status code 400 is not 200

8. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
   

Status code 400 is not 200

9. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
   

Status code 200 is not 400

10. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

11. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

12. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

13. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

14. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

15. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

16. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

17. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

18. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

19. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

20. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

21. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

22. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

23. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

24. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

25. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

26. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

27. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

28. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
    

Status code 200 is not 400

29. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

30. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

31. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

32. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
    

Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'

33. SHOULD use 200 status code on JSON parsing failure when accepting application/json
    

Status code 400 is not 200

34. SHOULD use 200 status code if parameters are invalid when accepting application/json
    

Status code 400 is not 200

35. SHOULD use 200 status code on document parsing failure when accepting application/json
    

Status code 400 is not 200

36. SHOULD use 200 status code on document validation failure when accepting application/json
    

Status code 400 is not 200

::notice::Implementation is compliant with the GraphQL over HTTP spec, but some optional audits fail. 37 audits pass out of 73 (36 warnings, 0 errors)