README.md

* This report was auto-generated by graphql-http

GraphQL over HTTP audit report

• 60 audits in total
• ✅ 58 pass
• ⚠️ 2 warnings (optional)

Passing

1. 22EB SHOULD accept application/graphql-response+json and match the content-type
2. 4655 MUST accept application/json and match the content-type
3. 82A3 MUST use utf-8 encoding when responding
4. BF61 MUST accept utf-8 encoded request
5. 78D5 MUST assume utf-8 in request if encoding is unspecified
6. 2C94 MUST accept POST requests
7. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
8. 9C48 MAY NOT allow executing mutations on GET requests
9. 9ABE MAY respond with 4xx status code if content-type is not supplied on POST requests
10. 03D4 MUST accept application/json POST requests
11. A5BF MAY use 400 status code when request body is missing on POST
12. 423L MAY use 400 status code on missing {query} parameter
13. LKJ0 MAY use 400 status code on object {query} parameter
14. LKJ1 MAY use 400 status code on number {query} parameter
15. LKJ2 MAY use 400 status code on boolean {query} parameter
16. LKJ3 MAY use 400 status code on array {query} parameter
17. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
18. 13EE MUST allow string {query} parameter when accepting application/json
19. 6C00 MAY use 400 status code on object {operationName} parameter
20. 6C01 MAY use 400 status code on number {operationName} parameter
21. 6C02 MAY use 400 status code on boolean {operationName} parameter
22. 6C03 MAY use 400 status code on array {operationName} parameter
23. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
24. B8B3 MUST allow string {operationName} parameter when accepting application/json
25. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
26. 0220 MUST allow null {variables} parameter when accepting application/json
27. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
28. 0221 MUST allow null {operationName} parameter when accepting application/json
29. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
30. 0222 MUST allow null {extensions} parameter when accepting application/json
31. 4760 MAY use 400 status code on string {variables} parameter
32. 4761 MAY use 400 status code on number {variables} parameter
33. 4762 MAY use 400 status code on boolean {variables} parameter
34. 4763 MAY use 400 status code on array {variables} parameter
35. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
36. 28B9 MUST allow map {variables} parameter when accepting application/json
37. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
38. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
39. 58B0 MAY use 400 status code on string {extensions} parameter
40. 58B1 MAY use 400 status code on number {extensions} parameter
41. 58B2 MAY use 400 status code on boolean {extensions} parameter
42. 58B3 MAY use 400 status code on array {extensions} parameter
43. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
44. 1B7A MUST allow map {extensions} parameter when accepting application/json
45. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
46. BCF8 MAY use 400 status code on JSON parsing failure
47. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
48. 3E3A MAY use 400 status code if parameters are invalid
49. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
50. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
51. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
52. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
53. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
54. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
55. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
56. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
57. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
58. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json

Warnings

The server SHOULD support these, but is not required.

1. 47DE SHOULD accept */* and use application/json for the content-type
   Response header content-type does not contain application/json

   {
     "statusText": "OK",
     "status": 200,
     "headers": {
       "transfer-encoding": "chunked",
       "server": "Kestrel",
       "date": "",
       "content-type": "application/graphql-response+json;charset=utf-8"
     },
     "body": {
       "data": {
         "__typename": "Query"
       }
     }
   }
   

2. 80D8 SHOULD assume application/json content-type when accept is missing
   Response header content-type does not contain application/json

   {
     "statusText": "OK",
     "status": 200,
     "headers": {
       "transfer-encoding": "chunked",
       "server": "Kestrel",
       "date": "",
       "content-type": "application/graphql-response+json;charset=utf-8"
     },
     "body": {
       "data": {
         "__typename": "Query"
       }
     }
   }