Skip to content

Latest commit

 

History

History
176 lines (171 loc) · 8.82 KB

README.md

File metadata and controls

176 lines (171 loc) · 8.82 KB

* This report was auto-generated by graphql-http

GraphQL over HTTP audit report

  • 73 audits in total
  • ✅ 43 pass
  • ⚠️ 30 warnings (optional)

Passing

  1. MUST accept application/json and match the content-type
  2. MUST use utf-8 encoding when responding
  3. MUST accept utf-8 encoding
  4. MUST assume utf-8 if encoding is unspecified
  5. MUST accept POST requests
  6. MAY accept application/x-www-form-urlencoded formatted GET requests
  7. MUST NOT allow executing mutations on GET requests
  8. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
  9. MUST accept application/json POST requests
  10. MUST require a request body on POST
  11. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
  12. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json
  13. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
  14. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
  15. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json
  16. SHOULD allow string {query} parameter when accepting application/graphql-response+json
  17. MUST allow string {query} parameter when accepting application/json
  18. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
  19. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
  20. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
  21. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
  22. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
  23. MUST allow string {operationName} parameter when accepting application/json
  24. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
  25. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json
  26. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
  27. MUST allow map {variables} parameter when accepting application/json
  28. SHOULD allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
  29. MUST allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
  30. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json
  31. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json
  32. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json
  33. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json
  34. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
  35. MUST allow map {extensions} parameter when accepting application/json
  36. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
  37. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
  38. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
  39. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
  40. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
  41. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
  42. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
  43. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json

Warnings

The server SHOULD support these, but is not required.

  1. SHOULD accept application/graphql-response+json and match the content-type
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
  1. SHOULD accept */* and use application/graphql-response+json for the content-type
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
  1. SHOULD assume application/graphql-response+json content-type when accept is missing
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
  1. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
Status code 200 is not 400
  1. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
Status code 200 is not 400
  1. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
Status code 200 is not 400
  1. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
Status code 200 is not 400
  1. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
  1. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
  1. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code on JSON parsing failure when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code if parameters are invalid when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code on document parsing failure when accepting application/json
Status code 400 is not 200
  1. SHOULD use 200 status code on document validation failure when accepting application/json
Status code 400 is not 200
  1. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
Data entry null is not undefined
  1. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
Data entry null is not undefined
  1. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
Data entry null is not undefined
  1. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
Data entry null is not undefined