From 5f5532b91c5b50baeaa6c22ad34892920c8b297b Mon Sep 17 00:00:00 2001 From: Denis Badurina Date: Thu, 23 Jan 2025 17:01:36 +0100 Subject: [PATCH 1/6] some shoulds are musts --- src/audits/server.ts | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/src/audits/server.ts b/src/audits/server.ts index c3708540..702acc20 100644 --- a/src/audits/server.ts +++ b/src/audits/server.ts @@ -40,9 +40,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { return [ // Media Types audit( - // TODO: convert to MUST after watershed '22EB', - 'SHOULD accept application/graphql-response+json and match the content-type', + 'MUST accept application/graphql-response+json and match the content-type', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -255,9 +254,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { ), ), audit( - // TODO: convert to MUST after watershed '34A2', - 'SHOULD allow string {query} parameter when accepting application/graphql-response+json', + 'MUST allow string {query} parameter when accepting application/graphql-response+json', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -312,9 +310,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { ), ), audit( - // TODO: convert to MUST after watershed '8161', - 'SHOULD allow string {operationName} parameter when accepting application/graphql-response+json', + 'MUST allow string {operationName} parameter when accepting application/graphql-response+json', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -353,8 +350,7 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { (parameter, index) => [ audit( `94B${index}`, - // TODO: convert to MUST after watershed - `SHOULD allow null {${parameter}} parameter when accepting application/graphql-response+json`, + `MUST allow null {${parameter}} parameter when accepting application/graphql-response+json`, async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -418,9 +414,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { ), ), audit( - // TODO: convert to MUST after watershed '2EA1', - 'SHOULD allow map {variables} parameter when accepting application/graphql-response+json', + 'MUST allow map {variables} parameter when accepting application/graphql-response+json', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -499,8 +494,7 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { ...['string', 0, false, ['array']].map((invalid, index) => audit( `58B${index}`, - // TODO: convert to MUST after watershed - `MAY use 400 status code on ${extendedTypeof( + `MUST use 400 status code on ${extendedTypeof( invalid, )} {extensions} parameter`, async () => { @@ -519,9 +513,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { ), ), audit( - // TODO: convert to MUST after watershed '428F', - 'SHOULD allow map {extensions} parameter when accepting application/graphql-response+json', + 'MUST allow map {extensions} parameter when accepting application/graphql-response+json', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -670,9 +663,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { ), // Response application/graphql-response+json audit( - // TODO: convert to MUST after watershed '865D', - 'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', + 'MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', @@ -722,9 +714,8 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] { }, ), audit( - // TODO: convert to MUST after watershed '51FE', - 'SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', + 'MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => { const res = await fetchFn(await getUrl(opts.url), { method: 'POST', From e403aae506f6c134f835e566c611b44621c8ab14 Mon Sep 17 00:00:00 2001 From: theguild-bot Date: Thu, 23 Jan 2025 16:06:13 +0000 Subject: [PATCH 2/6] docs(implementations): audit report --- README.md | 4 - implementations/apollo-server/README.md | 28 +- implementations/deno/README.md | 215 ++++++++------- implementations/deno/report.json | 6 +- implementations/express-graphql/README.md | 221 +++++++-------- implementations/express-graphql/report.json | 6 +- implementations/graph-client/README.md | 28 +- implementations/graphql-helix/README.md | 209 +++++++------- implementations/graphql-helix/report.json | 6 +- implementations/graphql-yoga/README.md | 28 +- implementations/hotchocolate/README.md | 32 +-- implementations/lighthouse/README.md | 289 ++++++++++---------- implementations/lighthouse/report.json | 6 +- implementations/mercurius/README.md | 122 ++++----- implementations/mercurius/report.json | 4 +- implementations/postgraphile/README.md | 191 ++++++------- implementations/postgraphile/report.json | 6 +- implementations/thegraph/README.md | 116 ++++---- implementations/thegraph/report.json | 6 +- 19 files changed, 772 insertions(+), 751 deletions(-) diff --git a/README.md b/README.md index 561e58e3..bbc37aef 100644 --- a/README.md +++ b/README.md @@ -890,14 +890,10 @@ Their compliance with the [GraphQL over HTTP spec](https://graphql.github.io/gra | Name | Audit | |------|-------| | [apollo-server](https://www.apollographql.com/docs/apollo-server) | [✅ Compliant](/implementations/apollo-server/README.md) | -| [deno](https://deno.com/blog/build-a-graphql-server-with-deno) | [✅ Compliant](/implementations/deno/README.md) | | [graph-client](https://github.com/graphprotocol/graph-client) | [✅ Compliant](/implementations/graph-client/README.md) | -| [graphql-helix](https://www.graphql-helix.com) | [✅ Compliant](/implementations/graphql-helix/README.md) | | [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant](/implementations/graphql-yoga/README.md) | | [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant](/implementations/hotchocolate/README.md) | -| [lighthouse](https://lighthouse-php.com) | [✅ Compliant](/implementations/lighthouse/README.md) | | [pioneer](https://pioneer.dexclaimation.com) | [✅ Compliant](/implementations/pioneer/README.md) | -| [postgraphile](https://www.graphile.org/postgraphile) | [✅ Compliant](/implementations/postgraphile/README.md) | diff --git a/implementations/apollo-server/README.md b/implementations/apollo-server/README.md index d267c757..8f4cdacd 100644 --- a/implementations/apollo-server/README.md +++ b/implementations/apollo-server/README.md @@ -11,7 +11,7 @@

Passing

    -
  1. 22EB SHOULD accept application/graphql-response+json and match the content-type
    2. +
  2. 22EB MUST accept application/graphql-response+json and match the content-type
  3. 4655 MUST accept application/json and match the content-type
  4. 47DE SHOULD accept */* and use application/json for the content-type
  5. 80D8 SHOULD assume application/json content-type when accept is missing
    6. @@ -28,40 +28,40 @@
  6. LKJ1 MAY use 400 status code on number {query} parameter
  7. LKJ2 MAY use 400 status code on boolean {query} parameter
  8. LKJ3 MAY use 400 status code on array {query} parameter
    9. -
  9. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
    10. +
  10. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
  11. 13EE MUST allow string {query} parameter when accepting application/json
  12. 6C00 MAY use 400 status code on object {operationName} parameter
  13. 6C01 MAY use 400 status code on number {operationName} parameter
  14. 6C02 MAY use 400 status code on boolean {operationName} parameter
  15. 6C03 MAY use 400 status code on array {operationName} parameter
    16. -
  16. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
    17. +
  17. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
  18. B8B3 MUST allow string {operationName} parameter when accepting application/json
    19. -
  19. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
    20. +
  20. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
  21. 0220 MUST allow null {variables} parameter when accepting application/json
    22. -
  22. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
    23. +
  23. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
  24. 0221 MUST allow null {operationName} parameter when accepting application/json
    25. -
  25. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
    26. +
  26. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
  27. 0222 MUST allow null {extensions} parameter when accepting application/json
  28. 4760 MAY use 400 status code on string {variables} parameter
  29. 4761 MAY use 400 status code on number {variables} parameter
  30. 4762 MAY use 400 status code on boolean {variables} parameter
  31. 4763 MAY use 400 status code on array {variables} parameter
    32. -
  32. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
    33. +
  33. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
  34. 28B9 MUST allow map {variables} parameter when accepting application/json
    35. -
  35. 58B0 MAY use 400 status code on string {extensions} parameter
    36. -
  36. 58B1 MAY use 400 status code on number {extensions} parameter
    37. -
  37. 58B2 MAY use 400 status code on boolean {extensions} parameter
    38. -
  38. 58B3 MAY use 400 status code on array {extensions} parameter
    39. -
  39. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
    40. +
  40. 58B0 MUST use 400 status code on string {extensions} parameter
    41. +
  41. 58B1 MUST use 400 status code on number {extensions} parameter
    42. +
  42. 58B2 MUST use 400 status code on boolean {extensions} parameter
    43. +
  43. 58B3 MUST use 400 status code on array {extensions} parameter
    44. +
  44. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
  45. 1B7A MUST allow map {extensions} parameter when accepting application/json
  46. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
  47. BCF8 MAY use 400 status code on JSON parsing failure
  48. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
  49. 3E3A MAY use 400 status code if parameters are invalid
    50. -
  50. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    51. +
  51. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
  52. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
  53. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
    54. -
  54. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
    55. +
  55. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
  56. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
  57. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
  58. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
    59. diff --git a/implementations/deno/README.md b/implementations/deno/README.md index 4712b2be..2b841a92 100644 --- a/implementations/deno/README.md +++ b/implementations/deno/README.md @@ -5,8 +5,9 @@
    • 60 audits in total
    • ✅ 29 pass
      • -
    • 💡 18 notices (suggestions)
      • -
    • ❗️ 13 warnings (optional)
      • +
    • 💡 14 notices (suggestions)
      • +
    • ❗️ 5 warnings (optional)
      • +
    • ❌ 12 errors (required)

    Passing

    @@ -38,8 +39,8 @@
  59. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
  60. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
  61. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
    62. -
  62. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    63. -
  63. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
    64. +
  64. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    65. +
  65. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json

Notices

@@ -315,9 +316,9 @@ The server MAY support these, but are truly optional. These are suggestio -
  • 58B0 MAY use 400 status code on string {extensions} parameter +
  • 8764 MAY use 4xx or 5xx status codes if parameters are invalid
    -Response status code is not 400 +Response status is not between 400 and 599 
    {
   "statusText": "OK",
   "status": 200,
@@ -325,19 +326,19 @@ The server MAY support these, but are truly optional. These are suggestio
     "vary": "Accept-Encoding",
     "date": "",
     "content-type": "application/json",
-    "content-length": "59",
+    "content-length": "45",
     "content-encoding": "gzip"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {}
+    ]
   }
 }
    • -
  • 58B1 MAY use 400 status code on number {extensions} parameter +
  • 3E3A MAY use 400 status code if parameters are invalid
    Response status code is not 400 
    {
@@ -347,114 +348,94 @@ The server MAY support these, but are truly optional. These are suggestio
     "vary": "Accept-Encoding",
     "date": "",
     "content-type": "application/json",
-    "content-length": "59",
+    "content-length": "45",
     "content-encoding": "gzip"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {}
+    ]
   }
 }
    • -
  • 58B2 MAY use 400 status code on boolean {extensions} parameter + + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      Response status code is not 400 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Not Acceptable",
+  "status": 406,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "application/json",
-    "content-length": "59",
-    "content-encoding": "gzip"
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
   },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
+  "body": "Not Acceptable"
 }
      2. -
    2. 58B3 MAY use 400 status code on array {extensions} parameter +
    3. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      -Response status code is not 400 +Response body is not valid JSON 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Not Acceptable",
+  "status": 406,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "application/json",
-    "content-length": "59",
-    "content-encoding": "gzip"
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
   },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
+  "body": null
 }
      4. -
    4. 8764 MAY use 4xx or 5xx status codes if parameters are invalid +
    5. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      -Response status is not between 400 and 599 +Response status code is not 400 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Not Acceptable",
+  "status": 406,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "application/json",
-    "content-length": "45",
-    "content-encoding": "gzip"
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
   },
-  "body": {
-    "errors": [
-      {}
-    ]
-  }
+  "body": "Not Acceptable"
 }
      6. -
    6. 3E3A MAY use 400 status code if parameters are invalid +
    7. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      -Response status code is not 400 +Response body is not valid JSON 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Not Acceptable",
+  "status": 406,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "application/json",
-    "content-length": "45",
-    "content-encoding": "gzip"
+    "content-type": "text/plain;charset=UTF-8",
+    "content-length": "14"
   },
-  "body": {
-    "errors": [
-      {}
-    ]
-  }
+  "body": null
 }
      8. -
    - -

    Warnings

    -The server SHOULD support these, but is not required. -
      -
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
    2. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
      -Response status code is not 200 +Response status code is not 400 
      {
   "statusText": "Not Acceptable",
   "status": 406,
@@ -469,7 +450,12 @@ The server SHOULD support these, but is not required.
      3. -
    3. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json +
    + +

    Errors

    +The server MUST support these. +
      +
    1. 22EB MUST accept application/graphql-response+json and match the content-type
      Response status code is not 200 
      {
@@ -486,7 +472,7 @@ The server SHOULD support these, but is not required.
      2. -
    2. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json +
    3. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
      Response status code is not 200 
      {
@@ -503,7 +489,7 @@ The server SHOULD support these, but is not required.
      4. -
    4. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json +
    5. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
      Response status code is not 200 
      {
@@ -520,7 +506,7 @@ The server SHOULD support these, but is not required.
      6. -
    6. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json +
    7. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
      Response status code is not 200 
      {
@@ -537,7 +523,7 @@ The server SHOULD support these, but is not required.
      8. -
    8. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json +
    9. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
      Response status code is not 200 
      {
@@ -554,7 +540,7 @@ The server SHOULD support these, but is not required.
      10. -
    10. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json +
    11. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
      Response status code is not 200 
      {
@@ -571,7 +557,7 @@ The server SHOULD support these, but is not required.
      12. -
    12. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json +
    13. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
      Response status code is not 200 
      {
@@ -588,77 +574,97 @@ The server SHOULD support these, but is not required.
      14. -
    14. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json +
    15. 58B0 MUST use 400 status code on string {extensions} parameter
      Response status code is not 400 
      {
-  "statusText": "Not Acceptable",
-  "status": 406,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "text/plain;charset=UTF-8",
-    "content-length": "14"
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
   },
-  "body": "Not Acceptable"
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
 }
      16. -
    16. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json +
    17. 58B1 MUST use 400 status code on number {extensions} parameter
      -Response body is not valid JSON +Response status code is not 400 
      {
-  "statusText": "Not Acceptable",
-  "status": 406,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "text/plain;charset=UTF-8",
-    "content-length": "14"
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
   },
-  "body": null
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
 }
      18. -
    18. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json +
    19. 58B2 MUST use 400 status code on boolean {extensions} parameter
      Response status code is not 400 
      {
-  "statusText": "Not Acceptable",
-  "status": 406,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "text/plain;charset=UTF-8",
-    "content-length": "14"
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
   },
-  "body": "Not Acceptable"
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
 }
      20. -
    20. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json +
    21. 58B3 MUST use 400 status code on array {extensions} parameter
      -Response body is not valid JSON +Response status code is not 400 
      {
-  "statusText": "Not Acceptable",
-  "status": 406,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "vary": "Accept-Encoding",
     "date": "",
-    "content-type": "text/plain;charset=UTF-8",
-    "content-length": "14"
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
   },
-  "body": null
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
 }
      22. -
    22. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json +
    23. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
      -Response status code is not 400 +Response status code is not 200 
      {
   "statusText": "Not Acceptable",
   "status": 406,
@@ -674,4 +680,3 @@ The server SHOULD support these, but is not required.
    - diff --git a/implementations/deno/report.json b/implementations/deno/report.json index b5658aa1..2422feeb 100644 --- a/implementations/deno/report.json +++ b/implementations/deno/report.json @@ -1,7 +1,7 @@ { "total": 60, "ok": 29, - "notice": 18, - "warn": 13, - "error": 0 + "notice": 14, + "warn": 5, + "error": 12 } diff --git a/implementations/express-graphql/README.md b/implementations/express-graphql/README.md index 50299fd3..2b646c62 100644 --- a/implementations/express-graphql/README.md +++ b/implementations/express-graphql/README.md @@ -5,8 +5,9 @@
    • 60 audits in total
    • ✅ 45 pass
      • -
    • 💡 11 notices (suggestions)
      • -
    • ❗️ 4 warnings (optional)
      • +
    • 💡 7 notices (suggestions)
      • +
    • ❗️ 3 warnings (optional)
      • +
    • ❌ 5 errors (required)

    Passing

    @@ -28,31 +29,31 @@
  • LKJ1 MAY use 400 status code on number {query} parameter
  • LKJ2 MAY use 400 status code on boolean {query} parameter
  • LKJ3 MAY use 400 status code on array {query} parameter
    • -
  • 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
    • +
  • 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
  • 13EE MUST allow string {query} parameter when accepting application/json
    • -
  • 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
    • +
  • 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
  • B8B3 MUST allow string {operationName} parameter when accepting application/json
    • -
  • 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
    • +
  • 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
  • 0220 MUST allow null {variables} parameter when accepting application/json
    • -
  • 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
    • +
  • 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
  • 0221 MUST allow null {operationName} parameter when accepting application/json
    • -
  • 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
    • +
  • 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
  • 0222 MUST allow null {extensions} parameter when accepting application/json
  • 4760 MAY use 400 status code on string {variables} parameter
    • -
  • 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
    • +
  • 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
  • 28B9 MUST allow map {variables} parameter when accepting application/json
  • D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
  • 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
    • -
  • 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
    • +
  • 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
  • 1B7A MUST allow map {extensions} parameter when accepting application/json
  • B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
  • BCF8 MAY use 400 status code on JSON parsing failure
  • 8764 MAY use 4xx or 5xx status codes if parameters are invalid
  • 3E3A MAY use 400 status code if parameters are invalid
    • -
  • 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    • +
  • 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
  • 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
  • D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
    • -
  • 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
    • +
  • 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
  • 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
  • 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
  • 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
    • @@ -229,81 +230,124 @@ The server MAY support these, but are truly optional. These are suggestio     -
  • 58B0 MAY use 400 status code on string {extensions} parameter + + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      -Response status code is not 400 +Response status code is not 200 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
-    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "etag": "W/\"68-Xc/MwYKGMF54XYivaA3tsxvGHZM\"",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
+    "content-length": "104",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
+          }
+        ]
+      }
+    ]
   }
 }
      2. -
    2. 58B1 MAY use 400 status code on number {extensions} parameter +
    3. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      -Response status code is not 400 +Response status code is not 200 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
-    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "etag": "W/\"7b-vh2QJW5nlT/MclH/TbhHlNDXWZE\"",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
+    "content-length": "123",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
+          }
+        ]
+      }
+    ]
   }
 }
      4. -
    4. 58B2 MAY use 400 status code on boolean {extensions} parameter +
    5. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
      -Response status code is not 400 +Response status code is not 200 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
-    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "etag": "W/\"c6-jKvd+KIdPY2/2i/wYj0ck5PZF20\"",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
+    "content-length": "198",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Unknown type \"ID\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 26
+          }
+        ]
+      },
+      {
+        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 21
+          }
+        ]
+      }
+    ]
   }
 }
      6. -
    6. 58B3 MAY use 400 status code on array {extensions} parameter +
    + +

    Errors

    +The server MUST support these. +
      +
    1. 22EB MUST accept application/graphql-response+json and match the content-type
      -Response status code is not 400 +Response header content-type does not contain application/graphql-response+json 
      {
   "statusText": "OK",
   "status": 200,
@@ -325,14 +369,9 @@ The server MAY support these, but are truly optional. These are suggestio
      2. -
    - -

    Warnings

    -The server SHOULD support these, but is not required. -
      -
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
    2. 58B0 MUST use 400 status code on string {extensions} parameter
      -Response header content-type does not contain application/graphql-response+json +Response status code is not 400 
      {
   "statusText": "OK",
   "status": 200,
@@ -354,110 +393,76 @@ The server SHOULD support these, but is not required.
      3. -
    3. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
    4. 58B1 MUST use 400 status code on number {extensions} parameter
      -Response status code is not 200 +Response status code is not 400 
      {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
-    "etag": "W/\"68-Xc/MwYKGMF54XYivaA3tsxvGHZM\"",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "104",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Expected Name, found .",
-        "locations": [
-          {
-            "line": 1,
-            "column": 2
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
      5. -
    5. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
    6. 58B2 MUST use 400 status code on boolean {extensions} parameter
      -Response status code is not 200 +Response status code is not 400 
      {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
-    "etag": "W/\"7b-vh2QJW5nlT/MclH/TbhHlNDXWZE\"",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "123",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 4
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
      7. -
    7. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json +
    8. 58B3 MUST use 400 status code on array {extensions} parameter
      -Response status code is not 200 +Response status code is not 400 
      {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
-    "etag": "W/\"c6-jKvd+KIdPY2/2i/wYj0ck5PZF20\"",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "198",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Unknown type \"ID\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 26
-          }
-        ]
-      },
-      {
-        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 21
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
    - diff --git a/implementations/express-graphql/report.json b/implementations/express-graphql/report.json index 4099d182..03056bbe 100644 --- a/implementations/express-graphql/report.json +++ b/implementations/express-graphql/report.json @@ -1,7 +1,7 @@ { "total": 60, "ok": 45, - "notice": 11, - "warn": 4, - "error": 0 + "notice": 7, + "warn": 3, + "error": 5 } diff --git a/implementations/graph-client/README.md b/implementations/graph-client/README.md index 364f93c2..cac189ac 100644 --- a/implementations/graph-client/README.md +++ b/implementations/graph-client/README.md @@ -10,7 +10,7 @@

    Passing

      -
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 22EB MUST accept application/graphql-response+json and match the content-type
    3. 4655 MUST accept application/json and match the content-type
    4. 47DE SHOULD accept */* and use application/json for the content-type
    5. 80D8 SHOULD assume application/json content-type when accept is missing
      6. @@ -27,43 +27,43 @@
    6. LKJ1 MAY use 400 status code on number {query} parameter
    7. LKJ2 MAY use 400 status code on boolean {query} parameter
    8. LKJ3 MAY use 400 status code on array {query} parameter
      9. -
    9. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      10. +
    10. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
    11. 13EE MUST allow string {query} parameter when accepting application/json
    12. 6C00 MAY use 400 status code on object {operationName} parameter
    13. 6C01 MAY use 400 status code on number {operationName} parameter
    14. 6C02 MAY use 400 status code on boolean {operationName} parameter
    15. 6C03 MAY use 400 status code on array {operationName} parameter
      16. -
    16. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      17. +
    17. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
    18. B8B3 MUST allow string {operationName} parameter when accepting application/json
      19. -
    19. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      20. +
    20. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
    21. 0220 MUST allow null {variables} parameter when accepting application/json
      22. -
    22. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      23. +
    23. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
    24. 0221 MUST allow null {operationName} parameter when accepting application/json
      25. -
    25. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      26. +
    26. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
    27. 0222 MUST allow null {extensions} parameter when accepting application/json
    28. 4760 MAY use 400 status code on string {variables} parameter
    29. 4761 MAY use 400 status code on number {variables} parameter
    30. 4762 MAY use 400 status code on boolean {variables} parameter
    31. 4763 MAY use 400 status code on array {variables} parameter
      32. -
    32. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      33. +
    33. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
    34. 28B9 MUST allow map {variables} parameter when accepting application/json
    35. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
    36. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      37. -
    37. 58B0 MAY use 400 status code on string {extensions} parameter
      38. -
    38. 58B1 MAY use 400 status code on number {extensions} parameter
      39. -
    39. 58B2 MAY use 400 status code on boolean {extensions} parameter
      40. -
    40. 58B3 MAY use 400 status code on array {extensions} parameter
      41. -
    41. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      42. +
    42. 58B0 MUST use 400 status code on string {extensions} parameter
      43. +
    43. 58B1 MUST use 400 status code on number {extensions} parameter
      44. +
    44. 58B2 MUST use 400 status code on boolean {extensions} parameter
      45. +
    45. 58B3 MUST use 400 status code on array {extensions} parameter
      46. +
    46. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
    47. 1B7A MUST allow map {extensions} parameter when accepting application/json
    48. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
    49. 3E3A MAY use 400 status code if parameters are invalid
    50. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
    51. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
    52. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
      53. -
    53. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      54. +
    54. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    55. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
    56. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      57. -
    57. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      58. +
    58. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
    59. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
    60. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
    61. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
      62. diff --git a/implementations/graphql-helix/README.md b/implementations/graphql-helix/README.md index 72631835..46ce3ddc 100644 --- a/implementations/graphql-helix/README.md +++ b/implementations/graphql-helix/README.md @@ -5,8 +5,9 @@
      • 60 audits in total
      • ✅ 49 pass
        • -
      • 💡 7 notices (suggestions)
        • -
      • ❗️ 4 warnings (optional)
        • +
      • 💡 3 notices (suggestions)
        • +
      • ❗️ 3 warnings (optional)
        • +
      • ❌ 5 errors (required)

      Passing

      @@ -28,35 +29,35 @@
    62. LKJ1 MAY use 400 status code on number {query} parameter
    63. LKJ2 MAY use 400 status code on boolean {query} parameter
    64. LKJ3 MAY use 400 status code on array {query} parameter
      65. -
    65. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      66. +
    66. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
    67. 13EE MUST allow string {query} parameter when accepting application/json
    68. 6C00 MAY use 400 status code on object {operationName} parameter
    69. 6C01 MAY use 400 status code on number {operationName} parameter
    70. 6C02 MAY use 400 status code on boolean {operationName} parameter
    71. 6C03 MAY use 400 status code on array {operationName} parameter
      72. -
    72. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      73. +
    73. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
    74. B8B3 MUST allow string {operationName} parameter when accepting application/json
      75. -
    75. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      76. +
    76. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
    77. 0220 MUST allow null {variables} parameter when accepting application/json
      78. -
    78. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      79. +
    79. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
    80. 0221 MUST allow null {operationName} parameter when accepting application/json
      81. -
    81. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      82. +
    82. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
    83. 0222 MUST allow null {extensions} parameter when accepting application/json
    84. 4760 MAY use 400 status code on string {variables} parameter
      85. -
    85. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      86. +
    86. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
    87. 28B9 MUST allow map {variables} parameter when accepting application/json
    88. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
    89. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      90. -
    90. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      91. +
    91. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
    92. 1B7A MUST allow map {extensions} parameter when accepting application/json
    93. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
    94. BCF8 MAY use 400 status code on JSON parsing failure
    95. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
    96. 3E3A MAY use 400 status code if parameters are invalid
      97. -
    97. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      98. +
    98. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    99. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
    100. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      101. -
    101. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      102. +
    102. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
    103. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
    104. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
    105. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
      106. @@ -134,78 +135,121 @@ The server MAY support these, but are truly optional. These are suggestio -
    106. 58B0 MAY use 400 status code on string {extensions} parameter +
    + +

    Warnings

    +The server SHOULD support these, but is not required. +
      +
    1. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      -Response status code is not 400 +Response status code is not 200 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json",
-    "content-length": "31",
+    "content-length": "104",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
+          }
+        ]
+      }
+    ]
   }
 }
      2. -
    2. 58B1 MAY use 400 status code on number {extensions} parameter +
    3. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      -Response status code is not 400 +Response status code is not 200 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json",
-    "content-length": "31",
+    "content-length": "123",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
+          }
+        ]
+      }
+    ]
   }
 }
      4. -
    4. 58B2 MAY use 400 status code on boolean {extensions} parameter +
    5. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
      -Response status code is not 400 +Response status code is not 200 
      {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json",
-    "content-length": "31",
+    "content-length": "198",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Unknown type \"ID\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 26
+          }
+        ]
+      },
+      {
+        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 21
+          }
+        ]
+      }
+    ]
   }
 }
      6. -
    6. 58B3 MAY use 400 status code on array {extensions} parameter +
    + +

    Errors

    +The server MUST support these. +
      +
    1. 22EB MUST accept application/graphql-response+json and match the content-type
      -Response status code is not 400 +Response header content-type does not contain application/graphql-response+json 
      {
   "statusText": "OK",
   "status": 200,
@@ -226,14 +270,9 @@ The server MAY support these, but are truly optional. These are suggestio
      2. -
    - -

    Warnings

    -The server SHOULD support these, but is not required. -
      -
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
    2. 58B0 MUST use 400 status code on string {extensions} parameter
      -Response header content-type does not contain application/graphql-response+json +Response status code is not 400 
      {
   "statusText": "OK",
   "status": 200,
@@ -254,107 +293,73 @@ The server SHOULD support these, but is not required.
      3. -
    3. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
    4. 58B1 MUST use 400 status code on number {extensions} parameter
      -Response status code is not 200 +Response status code is not 400 
      {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json",
-    "content-length": "104",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Expected Name, found .",
-        "locations": [
-          {
-            "line": 1,
-            "column": 2
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
      5. -
    5. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
    6. 58B2 MUST use 400 status code on boolean {extensions} parameter
      -Response status code is not 200 +Response status code is not 400 
      {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json",
-    "content-length": "123",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 4
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
      7. -
    7. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json +
    8. 58B3 MUST use 400 status code on array {extensions} parameter
      -Response status code is not 200 +Response status code is not 400 
      {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "x-powered-by": "Express",
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json",
-    "content-length": "198",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Unknown type \"ID\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 26
-          }
-        ]
-      },
-      {
-        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 21
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
    - diff --git a/implementations/graphql-helix/report.json b/implementations/graphql-helix/report.json index a7e67865..3d69c639 100644 --- a/implementations/graphql-helix/report.json +++ b/implementations/graphql-helix/report.json @@ -1,7 +1,7 @@ { "total": 60, "ok": 49, - "notice": 7, - "warn": 4, - "error": 0 + "notice": 3, + "warn": 3, + "error": 5 } diff --git a/implementations/graphql-yoga/README.md b/implementations/graphql-yoga/README.md index 9c15aea4..7555d3f0 100644 --- a/implementations/graphql-yoga/README.md +++ b/implementations/graphql-yoga/README.md @@ -9,7 +9,7 @@

    Passing

      -
    1. 22EB SHOULD accept application/graphql-response+json and match the content-type
      2. +
    2. 22EB MUST accept application/graphql-response+json and match the content-type
    3. 4655 MUST accept application/json and match the content-type
    4. 47DE SHOULD accept */* and use application/json for the content-type
    5. 80D8 SHOULD assume application/json content-type when accept is missing
      6. @@ -27,33 +27,33 @@
    6. LKJ1 MAY use 400 status code on number {query} parameter
    7. LKJ2 MAY use 400 status code on boolean {query} parameter
    8. LKJ3 MAY use 400 status code on array {query} parameter
      9. -
    9. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
      10. +
    10. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
    11. 13EE MUST allow string {query} parameter when accepting application/json
    12. 6C00 MAY use 400 status code on object {operationName} parameter
    13. 6C01 MAY use 400 status code on number {operationName} parameter
    14. 6C02 MAY use 400 status code on boolean {operationName} parameter
    15. 6C03 MAY use 400 status code on array {operationName} parameter
      16. -
    16. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
      17. +
    17. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
    18. B8B3 MUST allow string {operationName} parameter when accepting application/json
      19. -
    19. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
      20. +
    20. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
    21. 0220 MUST allow null {variables} parameter when accepting application/json
      22. -
    22. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
      23. +
    23. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
    24. 0221 MUST allow null {operationName} parameter when accepting application/json
      25. -
    25. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
      26. +
    26. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
    27. 0222 MUST allow null {extensions} parameter when accepting application/json
    28. 4760 MAY use 400 status code on string {variables} parameter
    29. 4761 MAY use 400 status code on number {variables} parameter
    30. 4762 MAY use 400 status code on boolean {variables} parameter
    31. 4763 MAY use 400 status code on array {variables} parameter
      32. -
    32. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
      33. +
    33. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
    34. 28B9 MUST allow map {variables} parameter when accepting application/json
    35. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
    36. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
      37. -
    37. 58B0 MAY use 400 status code on string {extensions} parameter
      38. -
    38. 58B1 MAY use 400 status code on number {extensions} parameter
      39. -
    39. 58B2 MAY use 400 status code on boolean {extensions} parameter
      40. -
    40. 58B3 MAY use 400 status code on array {extensions} parameter
      41. -
    41. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
      42. +
    42. 58B0 MUST use 400 status code on string {extensions} parameter
      43. +
    43. 58B1 MUST use 400 status code on number {extensions} parameter
      44. +
    44. 58B2 MUST use 400 status code on boolean {extensions} parameter
      45. +
    45. 58B3 MUST use 400 status code on array {extensions} parameter
      46. +
    46. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
    47. 1B7A MUST allow map {extensions} parameter when accepting application/json
    48. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
    49. BCF8 MAY use 400 status code on JSON parsing failure
      50. @@ -62,10 +62,10 @@
    50. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
    51. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
    52. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
      53. -
    53. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      54. +
    54. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
    55. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
    56. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
      57. -
    57. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      58. +
    58. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
    59. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
    60. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
    61. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
      62. diff --git a/implementations/hotchocolate/README.md b/implementations/hotchocolate/README.md index cb066ff6..902cd383 100644 --- a/implementations/hotchocolate/README.md +++ b/implementations/hotchocolate/README.md @@ -10,7 +10,7 @@

      Passing

        -
      1. 22EB SHOULD accept application/graphql-response+json and match the content-type
        2. +
      2. 22EB MUST accept application/graphql-response+json and match the content-type
      3. 4655 MUST accept application/json and match the content-type
      4. 82A3 MUST use utf-8 encoding when responding
      5. BF61 MUST accept utf-8 encoded request
        6. @@ -26,33 +26,33 @@
      6. LKJ1 MAY use 400 status code on number {query} parameter
      7. LKJ2 MAY use 400 status code on boolean {query} parameter
      8. LKJ3 MAY use 400 status code on array {query} parameter
        9. -
      9. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
        10. +
      10. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
      11. 13EE MUST allow string {query} parameter when accepting application/json
      12. 6C00 MAY use 400 status code on object {operationName} parameter
      13. 6C01 MAY use 400 status code on number {operationName} parameter
      14. 6C02 MAY use 400 status code on boolean {operationName} parameter
      15. 6C03 MAY use 400 status code on array {operationName} parameter
        16. -
      16. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
        17. +
      17. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
      18. B8B3 MUST allow string {operationName} parameter when accepting application/json
        19. -
      19. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
        20. +
      20. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
      21. 0220 MUST allow null {variables} parameter when accepting application/json
        22. -
      22. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
        23. +
      23. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
      24. 0221 MUST allow null {operationName} parameter when accepting application/json
        25. -
      25. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
        26. +
      26. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
      27. 0222 MUST allow null {extensions} parameter when accepting application/json
      28. 4760 MAY use 400 status code on string {variables} parameter
      29. 4761 MAY use 400 status code on number {variables} parameter
      30. 4762 MAY use 400 status code on boolean {variables} parameter
      31. 4763 MAY use 400 status code on array {variables} parameter
        32. -
      32. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
        33. +
      33. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
      34. 28B9 MUST allow map {variables} parameter when accepting application/json
      35. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      36. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
        37. -
      37. 58B0 MAY use 400 status code on string {extensions} parameter
        38. -
      38. 58B1 MAY use 400 status code on number {extensions} parameter
        39. -
      39. 58B2 MAY use 400 status code on boolean {extensions} parameter
        40. -
      40. 58B3 MAY use 400 status code on array {extensions} parameter
        41. -
      41. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
        42. +
      42. 58B0 MUST use 400 status code on string {extensions} parameter
        43. +
      43. 58B1 MUST use 400 status code on number {extensions} parameter
        44. +
      44. 58B2 MUST use 400 status code on boolean {extensions} parameter
        45. +
      45. 58B3 MUST use 400 status code on array {extensions} parameter
        46. +
      46. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
      47. 1B7A MUST allow map {extensions} parameter when accepting application/json
      48. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
      49. BCF8 MAY use 400 status code on JSON parsing failure
        50. @@ -61,10 +61,10 @@
      50. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      51. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      52. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
        53. -
      53. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
        54. +
      54. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      55. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
      56. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
        57. -
      57. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
        58. +
      58. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      59. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      60. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
      61. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
        62. @@ -83,7 +83,7 @@ The server SHOULD support these, but is not required. "transfer-encoding": "chunked", "server": "Kestrel", "date": "", - "content-type": "application/graphql-response+json;charset=utf-8" + "content-type": "application/graphql-response+json; charset=utf-8" }, "body": { "data": { @@ -104,7 +104,7 @@ The server SHOULD support these, but is not required. "transfer-encoding": "chunked", "server": "Kestrel", "date": "", - "content-type": "application/graphql-response+json;charset=utf-8" + "content-type": "application/graphql-response+json; charset=utf-8" }, "body": { "data": { diff --git a/implementations/lighthouse/README.md b/implementations/lighthouse/README.md index 49f21d60..fb3ce764 100644 --- a/implementations/lighthouse/README.md +++ b/implementations/lighthouse/README.md @@ -5,8 +5,9 @@
        • 60 audits in total
        • ✅ 33 pass
          • -
        • 💡 21 notices (suggestions)
          • -
        • ❗️ 6 warnings (optional)
          • +
        • 💡 17 notices (suggestions)
          • +
        • ❗️ 3 warnings (optional)
          • +
        • ❌ 7 errors (required)

        Passing

        @@ -21,21 +22,21 @@
      62. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      63. 03D4 MUST accept application/json POST requests
      64. A5BF MAY use 400 status code when request body is missing on POST
        65. -
      65. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
        66. +
      66. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
      67. 13EE MUST allow string {query} parameter when accepting application/json
        68. -
      68. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
        69. +
      69. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
      70. B8B3 MUST allow string {operationName} parameter when accepting application/json
        71. -
      71. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
        72. +
      72. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
      73. 0220 MUST allow null {variables} parameter when accepting application/json
        74. -
      74. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
        75. +
      75. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
      76. 0221 MUST allow null {operationName} parameter when accepting application/json
        77. -
      77. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
        78. +
      78. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
      79. 0222 MUST allow null {extensions} parameter when accepting application/json
        80. -
      80. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
        81. +
      81. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
      82. 28B9 MUST allow map {variables} parameter when accepting application/json
      83. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      84. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
        85. -
      85. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
        86. +
      86. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
      87. 1B7A MUST allow map {extensions} parameter when accepting application/json
      88. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
      89. BCF8 MAY use 400 status code on JSON parsing failure
        90. @@ -3591,98 +3592,6 @@ The server MAY support these, but are truly optional. These are suggestio -
      90. 58B0 MAY use 400 status code on string {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "x-powered-by": "PHP/8.2.19",
-    "host": "localhost:4000",
-    "date": "",
-    "content-type": "application/json",
-    "connection": "close",
-    "cache-control": "no-cache, private"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        91. -
      91. 58B1 MAY use 400 status code on number {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "x-powered-by": "PHP/8.2.19",
-    "host": "localhost:4000",
-    "date": "",
-    "content-type": "application/json",
-    "connection": "close",
-    "cache-control": "no-cache, private"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        92. -
      92. 58B2 MAY use 400 status code on boolean {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "x-powered-by": "PHP/8.2.19",
-    "host": "localhost:4000",
-    "date": "",
-    "content-type": "application/json",
-    "connection": "close",
-    "cache-control": "no-cache, private"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        93. -
      93. 58B3 MAY use 400 status code on array {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "x-powered-by": "PHP/8.2.19",
-    "host": "localhost:4000",
-    "date": "",
-    "content-type": "application/json",
-    "connection": "close",
-    "cache-control": "no-cache, private"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
      94. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
        Response status is not between 400 and 599 @@ -4180,9 +4089,9 @@ The server MAY support these, but are truly optional. These are suggestio

        Warnings

        The server SHOULD support these, but is not required.
          -
        1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
        2. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
          -Response header content-type does not contain application/graphql-response+json +Response status code is not 400 
          {
   "statusText": "OK",
   "status": 200,
@@ -4195,17 +4104,29 @@ The server SHOULD support these, but is not required.
     "cache-control": "no-cache, private"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Expected Name, found ",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
+          }
+        ],
+        "extensions": {
+          "line": 382,
+          "file": "/app/vendor/webonyx/graphql-php/src/Language/Parser.php"
+        }
+      }
+    ]
   }
 }
          3. -
        3. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json +
        4. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
          -Response status is not between 400 and 599 +Response status code is not 400 
          {
   "statusText": "OK",
   "status": 200,
@@ -4220,11 +4141,11 @@ The server SHOULD support these, but is not required.
   "body": {
     "errors": [
       {
-        "message": "Syntax Error: Expected Name, found ",
+        "message": "Syntax Error: Expected Name, found Int \"8\"",
         "locations": [
           {
             "line": 1,
-            "column": 2
+            "column": 3
           }
         ],
         "extensions": {
@@ -4238,7 +4159,7 @@ The server SHOULD support these, but is not required.
          5. -
        5. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json +
        6. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
          Response status code is not 400 
          {
@@ -4255,16 +4176,16 @@ The server SHOULD support these, but is not required.
   "body": {
     "errors": [
       {
-        "message": "Syntax Error: Expected Name, found ",
+        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
         "locations": [
           {
             "line": 1,
-            "column": 2
+            "column": 21
           }
         ],
         "extensions": {
-          "line": 382,
-          "file": "/app/vendor/webonyx/graphql-php/src/Language/Parser.php"
+          "line": 41,
+          "file": "/app/vendor/webonyx/graphql-php/src/Validator/Rules/NoUnusedVariables.php"
         }
       }
     ]
@@ -4273,9 +4194,37 @@ The server SHOULD support these, but is not required.
          7. -
        7. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json +
        + +

        Errors

        +The server MUST support these. +
          +
        1. 22EB MUST accept application/graphql-response+json and match the content-type +
          +Response header content-type does not contain application/graphql-response+json +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          2. +
        2. 58B0 MUST use 400 status code on string {extensions} parameter
          -Response status is not between 400 and 599 +Response status code is not 400 
          {
   "statusText": "OK",
   "status": 200,
@@ -4288,29 +4237,86 @@ The server SHOULD support these, but is not required.
     "cache-control": "no-cache, private"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Expected Name, found Int \"8\"",
-        "locations": [
-          {
-            "line": 1,
-            "column": 3
-          }
-        ],
-        "extensions": {
-          "line": 382,
-          "file": "/app/vendor/webonyx/graphql-php/src/Language/Parser.php"
-        }
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
          3. -
        3. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json +
        4. 58B1 MUST use 400 status code on number {extensions} parameter
          Response status code is not 400 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          5. +
        5. 58B2 MUST use 400 status code on boolean {extensions} parameter +
          +Response status code is not 400 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          6. +
        6. 58B3 MUST use 400 status code on array {extensions} parameter +
          +Response status code is not 400 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          7. +
        7. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json +
          +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -4325,11 +4331,11 @@ The server SHOULD support these, but is not required.
   "body": {
     "errors": [
       {
-        "message": "Syntax Error: Expected Name, found Int \"8\"",
+        "message": "Syntax Error: Expected Name, found ",
         "locations": [
           {
             "line": 1,
-            "column": 3
+            "column": 2
           }
         ],
         "extensions": {
@@ -4343,9 +4349,9 @@ The server SHOULD support these, but is not required.
          8. -
        8. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json +
        9. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -4360,16 +4366,16 @@ The server SHOULD support these, but is not required.
   "body": {
     "errors": [
       {
-        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
+        "message": "Syntax Error: Expected Name, found Int \"8\"",
         "locations": [
           {
             "line": 1,
-            "column": 21
+            "column": 3
           }
         ],
         "extensions": {
-          "line": 41,
-          "file": "/app/vendor/webonyx/graphql-php/src/Validator/Rules/NoUnusedVariables.php"
+          "line": 382,
+          "file": "/app/vendor/webonyx/graphql-php/src/Language/Parser.php"
         }
       }
     ]
@@ -4379,4 +4385,3 @@ The server SHOULD support these, but is not required.
        - diff --git a/implementations/lighthouse/report.json b/implementations/lighthouse/report.json index 9c2ceb34..f74b313c 100644 --- a/implementations/lighthouse/report.json +++ b/implementations/lighthouse/report.json @@ -1,7 +1,7 @@ { "total": 60, "ok": 33, - "notice": 21, - "warn": 6, - "error": 0 + "notice": 17, + "warn": 3, + "error": 7 } diff --git a/implementations/mercurius/README.md b/implementations/mercurius/README.md index 6f09dbb9..2373a8e6 100644 --- a/implementations/mercurius/README.md +++ b/implementations/mercurius/README.md @@ -6,8 +6,8 @@
      95. 60 audits in total
      96. ✅ 46 pass
      97. 💡 6 notices (suggestions)
        98. -
      98. ❗️ 7 warnings (optional)
        99. -
      99. ❌ 1 errors (required)
        100. +
      100. ❗️ 5 warnings (optional)
        101. +
      101. ❌ 3 errors (required)

        102. Passing

        @@ -27,36 +27,36 @@
      102. 423L MAY use 400 status code on missing {query} parameter
      103. LKJ0 MAY use 400 status code on object {query} parameter
      104. LKJ3 MAY use 400 status code on array {query} parameter
        105. -
      105. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
        106. +
      106. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
      107. 13EE MUST allow string {query} parameter when accepting application/json
      108. 6C00 MAY use 400 status code on object {operationName} parameter
      109. 6C03 MAY use 400 status code on array {operationName} parameter
        110. -
      110. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
        111. +
      111. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
      112. B8B3 MUST allow string {operationName} parameter when accepting application/json
        113. -
      113. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
        114. +
      114. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
      115. 0220 MUST allow null {variables} parameter when accepting application/json
        116. -
      116. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
        117. +
      117. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
      118. 0221 MUST allow null {operationName} parameter when accepting application/json
      119. 4760 MAY use 400 status code on string {variables} parameter
      120. 4763 MAY use 400 status code on array {variables} parameter
        121. -
      121. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
        122. +
      122. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
      123. 28B9 MUST allow map {variables} parameter when accepting application/json
      124. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
      125. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
        126. -
      126. 58B0 MAY use 400 status code on string {extensions} parameter
        127. -
      127. 58B1 MAY use 400 status code on number {extensions} parameter
        128. -
      128. 58B2 MAY use 400 status code on boolean {extensions} parameter
        129. -
      129. 58B3 MAY use 400 status code on array {extensions} parameter
        130. -
      130. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
        131. +
      131. 58B0 MUST use 400 status code on string {extensions} parameter
        132. +
      132. 58B1 MUST use 400 status code on number {extensions} parameter
        133. +
      133. 58B2 MUST use 400 status code on boolean {extensions} parameter
        134. +
      134. 58B3 MUST use 400 status code on array {extensions} parameter
        135. +
      135. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
      136. 1B7A MUST allow map {extensions} parameter when accepting application/json
      137. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
      138. BCF8 MAY use 400 status code on JSON parsing failure
      139. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
      140. 3E3A MAY use 400 status code if parameters are invalid
      141. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
        142. -
      142. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
        143. +
      143. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
      144. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
        145. -
      145. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
        146. +
      146. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
      147. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
      @@ -212,53 +212,6 @@ The server MAY support these, but are truly optional. These are suggestio

      Warnings

      The server SHOULD support these, but is not required.
        -
      1. 22EB SHOULD accept application/graphql-response+json and match the content-type -
        -Response header content-type does not contain application/graphql-response+json -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "keep-alive": "timeout=72",
-    "date": "",
-    "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
-    "connection": "keep-alive"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        2. -
      2. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json -
        -Response status code is not 200 -
        {
-  "statusText": "Bad Request",
-  "status": 400,
-  "headers": {
-    "keep-alive": "timeout=72",
-    "date": "",
-    "content-type": "application/json; charset=utf-8",
-    "content-length": "69",
-    "connection": "keep-alive"
-  },
-  "body": {
-    "errors": [
-      {
-        "message": "body/extensions must be object"
-      }
-    ],
-    "data": null
-  }
-}
-
        -
        -
      3. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
        Response status code is not 200 @@ -428,6 +381,53 @@ The server SHOULD support these, but is not required.

        Errors

        The server MUST support these.
          +
        1. 22EB MUST accept application/graphql-response+json and match the content-type +
          +Response header content-type does not contain application/graphql-response+json +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=72",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          2. +
        2. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json +
          +Response status code is not 200 +
          {
+  "statusText": "Bad Request",
+  "status": 400,
+  "headers": {
+    "keep-alive": "timeout=72",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "69",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "body/extensions must be object"
+      }
+    ],
+    "data": null
+  }
+}
+
          +
          +
        3. 0222 MUST allow null {extensions} parameter when accepting application/json
          Response status code is not 200 diff --git a/implementations/mercurius/report.json b/implementations/mercurius/report.json index d68f033b..f1686007 100644 --- a/implementations/mercurius/report.json +++ b/implementations/mercurius/report.json @@ -2,6 +2,6 @@ "total": 60, "ok": 46, "notice": 6, - "warn": 7, - "error": 1 + "warn": 5, + "error": 3 } diff --git a/implementations/postgraphile/README.md b/implementations/postgraphile/README.md index cea994fc..66ad52c4 100644 --- a/implementations/postgraphile/README.md +++ b/implementations/postgraphile/README.md @@ -5,8 +5,9 @@
          • 60 audits in total
          • ✅ 46 pass
            • -
          • 💡 10 notices (suggestions)
            • -
          • ❗️ 4 warnings (optional)
            • +
          • 💡 6 notices (suggestions)
            • +
          • ❗️ 3 warnings (optional)
            • +
          • ❌ 5 errors (required)

          Passing

          @@ -25,35 +26,35 @@
        4. 423L MAY use 400 status code on missing {query} parameter
        5. LKJ1 MAY use 400 status code on number {query} parameter
        6. LKJ2 MAY use 400 status code on boolean {query} parameter
          7. -
        7. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
          8. +
        8. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
        9. 13EE MUST allow string {query} parameter when accepting application/json
        10. 6C00 MAY use 400 status code on object {operationName} parameter
        11. 6C01 MAY use 400 status code on number {operationName} parameter
        12. 6C02 MAY use 400 status code on boolean {operationName} parameter
        13. 6C03 MAY use 400 status code on array {operationName} parameter
          14. -
        14. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
          15. +
        15. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
        16. B8B3 MUST allow string {operationName} parameter when accepting application/json
          17. -
        17. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json
          18. +
        18. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
        19. 0220 MUST allow null {variables} parameter when accepting application/json
          20. -
        20. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json
          21. +
        21. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
        22. 0221 MUST allow null {operationName} parameter when accepting application/json
          23. -
        23. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json
          24. +
        24. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
        25. 0222 MUST allow null {extensions} parameter when accepting application/json
        26. 4760 MAY use 400 status code on string {variables} parameter
        27. 4761 MAY use 400 status code on number {variables} parameter
        28. 4762 MAY use 400 status code on boolean {variables} parameter
          29. -
        29. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
          30. +
        30. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
        31. 28B9 MUST allow map {variables} parameter when accepting application/json
          32. -
        32. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
          33. +
        33. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
        34. 1B7A MUST allow map {extensions} parameter when accepting application/json
        35. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
        36. BCF8 MAY use 400 status code on JSON parsing failure
        37. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
        38. 3E3A MAY use 400 status code if parameters are invalid
          39. -
        39. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
          40. +
        40. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
        41. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
        42. D586 SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
          43. -
        43. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
          44. +
        44. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
        45. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
        46. 5E5B SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
        47. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
          48. @@ -207,75 +208,109 @@ The server MAY support these, but are truly optional. These are suggestio
          48. -
        48. 58B0 MAY use 400 status code on string {extensions} parameter +
        + +

        Warnings

        +The server SHOULD support these, but is not required. +
          +
        1. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
          -Response status code is not 400 +Response status code is not 200 
          {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
+    "content-length": "104",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Expected Name, found .",
+        "locations": [
+          {
+            "line": 1,
+            "column": 2
+          }
+        ]
+      }
+    ]
   }
 }
          2. -
        2. 58B1 MAY use 400 status code on number {extensions} parameter +
        3. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
          -Response status code is not 400 +Response status code is not 200 
          {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
+    "content-length": "123",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 4
+          }
+        ]
+      }
+    ]
   }
 }
          4. -
        4. 58B2 MAY use 400 status code on boolean {extensions} parameter +
        5. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
          -Response status code is not 400 +Response status code is not 200 
          {
-  "statusText": "OK",
-  "status": 200,
+  "statusText": "Bad Request",
+  "status": 400,
   "headers": {
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "31",
+    "content-length": "126",
     "connection": "keep-alive"
   },
   "body": {
-    "data": {
-      "__typename": "Query"
-    }
+    "errors": [
+      {
+        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
+        "locations": [
+          {
+            "line": 1,
+            "column": 21
+          }
+        ]
+      }
+    ]
   }
 }
          6. -
        6. 58B3 MAY use 400 status code on array {extensions} parameter +
        + +

        Errors

        +The server MUST support these. +
          +
        1. 22EB MUST accept application/graphql-response+json and match the content-type
          -Response status code is not 400 +Response header content-type does not contain application/graphql-response+json 
          {
   "statusText": "OK",
   "status": 200,
@@ -295,14 +330,9 @@ The server MAY support these, but are truly optional. These are suggestio
          2. -
        - -

        Warnings

        -The server SHOULD support these, but is not required. -
          -
        1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
        2. 58B0 MUST use 400 status code on string {extensions} parameter
          -Response header content-type does not contain application/graphql-response+json +Response status code is not 400 
          {
   "statusText": "OK",
   "status": 200,
@@ -322,95 +352,70 @@ The server SHOULD support these, but is not required.
          3. -
        3. 572B SHOULD use 200 status code on document parsing failure when accepting application/json +
        4. 58B1 MUST use 400 status code on number {extensions} parameter
          -Response status code is not 200 +Response status code is not 400 
          {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "104",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Expected Name, found .",
-        "locations": [
-          {
-            "line": 1,
-            "column": 2
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
          5. -
        5. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json +
        6. 58B2 MUST use 400 status code on boolean {extensions} parameter
          -Response status code is not 200 +Response status code is not 400 
          {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "123",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Syntax Error: Invalid number, expected digit but got: \"f\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 4
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
          7. -
        7. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json +
        8. 58B3 MUST use 400 status code on array {extensions} parameter
          -Response status code is not 200 +Response status code is not 400 
          {
-  "statusText": "Bad Request",
-  "status": 400,
+  "statusText": "OK",
+  "status": 200,
   "headers": {
     "keep-alive": "timeout=5",
     "date": "",
     "content-type": "application/json; charset=utf-8",
-    "content-length": "126",
+    "content-length": "31",
     "connection": "keep-alive"
   },
   "body": {
-    "errors": [
-      {
-        "message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
-        "locations": [
-          {
-            "line": 1,
-            "column": 21
-          }
-        ]
-      }
-    ]
+    "data": {
+      "__typename": "Query"
+    }
   }
 }
        - diff --git a/implementations/postgraphile/report.json b/implementations/postgraphile/report.json index af61c47d..f325f96c 100644 --- a/implementations/postgraphile/report.json +++ b/implementations/postgraphile/report.json @@ -1,7 +1,7 @@ { "total": 60, "ok": 46, - "notice": 10, - "warn": 4, - "error": 0 + "notice": 6, + "warn": 3, + "error": 5 } diff --git a/implementations/thegraph/README.md b/implementations/thegraph/README.md index 7f76bee8..d321ef68 100644 --- a/implementations/thegraph/README.md +++ b/implementations/thegraph/README.md @@ -5,9 +5,9 @@
        • 60 audits in total
        • ✅ 19 pass
          • -
        • 💡 25 notices (suggestions)
          • -
        • ❗️ 9 warnings (optional)
          • -
        • ❌ 7 errors (required)
          • +
        • 💡 21 notices (suggestions)
          • +
        • ❗️ 3 warnings (optional)
          • +
        • ❌ 17 errors (required)

        Passing

        @@ -21,11 +21,11 @@
      4. 2C94 MUST accept POST requests
      5. 5A70 MAY accept application/x-www-form-urlencoded formatted GET requests
      6. 03D4 MUST accept application/json POST requests
        7. -
      7. 34A2 SHOULD allow string {query} parameter when accepting application/graphql-response+json
        8. -
      8. 8161 SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
        9. -
      9. 2EA1 SHOULD allow map {variables} parameter when accepting application/graphql-response+json
        10. +
      10. 34A2 MUST allow string {query} parameter when accepting application/graphql-response+json
        11. +
      11. 8161 MUST allow string {operationName} parameter when accepting application/graphql-response+json
        12. +
      12. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
      13. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
        14. -
      14. 428F SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
        15. +
      15. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
      16. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
      17. FDE2 SHOULD use 200 status code on document validation failure when accepting application/json
      18. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
        19. @@ -614,9 +614,9 @@ The server MAY support these, but are truly optional. These are suggestio
        19. -
      19. 58B0 MAY use 400 status code on string {extensions} parameter +
      20. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
        -Response status code is not 400 +Response status is not between 400 and 499 
        {
   "statusText": "OK",
   "status": 200,
@@ -648,7 +648,7 @@ The server MAY support these, but are truly optional. These are suggestio
        21. -
      21. 58B1 MAY use 400 status code on number {extensions} parameter +
      22. BCF8 MAY use 400 status code on JSON parsing failure
        Response status code is not 400 
        {
@@ -682,9 +682,9 @@ The server MAY support these, but are truly optional. These are suggestio
        23. -
      23. 58B2 MAY use 400 status code on boolean {extensions} parameter +
      24. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
        -Response status code is not 400 +Response status is not between 400 and 599 
        {
   "statusText": "OK",
   "status": 200,
@@ -716,7 +716,7 @@ The server MAY support these, but are truly optional. These are suggestio
        25. -
      25. 58B3 MAY use 400 status code on array {extensions} parameter +
      26. 3E3A MAY use 400 status code if parameters are invalid
        Response status code is not 400 
        {
@@ -750,9 +750,14 @@ The server MAY support these, but are truly optional. These are suggestio
        27. -
      27. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure +
      + +

      Warnings

      +The server SHOULD support these, but is not required. +
        +
      1. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
        -Response status is not between 400 and 499 +Response status code is not 400 
        {
   "statusText": "OK",
   "status": 200,
@@ -784,7 +789,7 @@ The server MAY support these, but are truly optional. These are suggestio
        2. -
      2. BCF8 MAY use 400 status code on JSON parsing failure +
      3. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
        Response status code is not 400 
        {
@@ -818,9 +823,9 @@ The server MAY support these, but are truly optional. These are suggestio
        4. -
      4. 8764 MAY use 4xx or 5xx status codes if parameters are invalid +
      5. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
        -Response status is not between 400 and 599 +Response status code is not 400 
        {
   "statusText": "OK",
   "status": 200,
@@ -852,9 +857,14 @@ The server MAY support these, but are truly optional. These are suggestio
        6. -
      6. 3E3A MAY use 400 status code if parameters are invalid +
      + +

      Errors

      +The server MUST support these. +
        +
      1. 22EB MUST accept application/graphql-response+json and match the content-type
        -Response status code is not 400 +Response header content-type does not contain application/graphql-response+json 
        {
   "statusText": "OK",
   "status": 200,
@@ -886,14 +896,9 @@ The server MAY support these, but are truly optional. These are suggestio
        2. -
      - -

      Warnings

      -The server SHOULD support these, but is not required. -
        -
      1. 22EB SHOULD accept application/graphql-response+json and match the content-type +
      2. 13EE MUST allow string {query} parameter when accepting application/json
        -Response header content-type does not contain application/graphql-response+json +Response body execution result has a property "errors" 
        {
   "statusText": "OK",
   "status": 200,
@@ -925,7 +930,7 @@ The server SHOULD support these, but is not required.
        3. -
      3. 94B0 SHOULD allow null {variables} parameter when accepting application/graphql-response+json +
      4. B8B3 MUST allow string {operationName} parameter when accepting application/json
        Response body execution result has a property "errors" 
        {
@@ -959,7 +964,7 @@ The server SHOULD support these, but is not required.
        5. -
      5. 94B1 SHOULD allow null {operationName} parameter when accepting application/graphql-response+json +
      6. 94B0 MUST allow null {variables} parameter when accepting application/graphql-response+json
        Response body execution result has a property "errors" 
        {
@@ -993,7 +998,7 @@ The server SHOULD support these, but is not required.
        7. -
      7. 94B2 SHOULD allow null {extensions} parameter when accepting application/graphql-response+json +
      8. 0220 MUST allow null {variables} parameter when accepting application/json
        Response body execution result has a property "errors" 
        {
@@ -1027,9 +1032,9 @@ The server SHOULD support these, but is not required.
        9. -
      9. 865D SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json +
      10. 94B1 MUST allow null {operationName} parameter when accepting application/graphql-response+json
        -Response status is not between 400 and 599 +Response body execution result has a property "errors" 
        {
   "statusText": "OK",
   "status": 200,
@@ -1061,9 +1066,9 @@ The server SHOULD support these, but is not required.
        11. -
      11. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json +
      12. 0221 MUST allow null {operationName} parameter when accepting application/json
        -Response status code is not 400 +Response body execution result has a property "errors" 
        {
   "statusText": "OK",
   "status": 200,
@@ -1095,9 +1100,9 @@ The server SHOULD support these, but is not required.
        13. -
      13. 51FE SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json +
      14. 94B2 MUST allow null {extensions} parameter when accepting application/graphql-response+json
        -Response status is not between 400 and 599 +Response body execution result has a property "errors" 
        {
   "statusText": "OK",
   "status": 200,
@@ -1129,9 +1134,9 @@ The server SHOULD support these, but is not required.
        15. -
      15. 74FF SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json +
      16. 0222 MUST allow null {extensions} parameter when accepting application/json
        -Response status code is not 400 +Response body execution result has a property "errors" 
        {
   "statusText": "OK",
   "status": 200,
@@ -1163,9 +1168,9 @@ The server SHOULD support these, but is not required.
        17. -
      17. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json +
      18. 28B9 MUST allow map {variables} parameter when accepting application/json
        -Response status code is not 400 +Response body execution result has a property "errors" 
        {
   "statusText": "OK",
   "status": 200,
@@ -1197,14 +1202,9 @@ The server SHOULD support these, but is not required.
        19. -
      - -

      Errors

      -The server MUST support these. -
        -
      1. 13EE MUST allow string {query} parameter when accepting application/json +
      2. 58B0 MUST use 400 status code on string {extensions} parameter
        -Response body execution result has a property "errors" +Response status code is not 400 
        {
   "statusText": "OK",
   "status": 200,
@@ -1236,9 +1236,9 @@ The server MUST support these.
        3. -
      3. B8B3 MUST allow string {operationName} parameter when accepting application/json +
      4. 58B1 MUST use 400 status code on number {extensions} parameter
        -Response body execution result has a property "errors" +Response status code is not 400 
        {
   "statusText": "OK",
   "status": 200,
@@ -1270,9 +1270,9 @@ The server MUST support these.
        5. -
      5. 0220 MUST allow null {variables} parameter when accepting application/json +
      6. 58B2 MUST use 400 status code on boolean {extensions} parameter
        -Response body execution result has a property "errors" +Response status code is not 400 
        {
   "statusText": "OK",
   "status": 200,
@@ -1304,9 +1304,9 @@ The server MUST support these.
        7. -
      7. 0221 MUST allow null {operationName} parameter when accepting application/json +
      8. 58B3 MUST use 400 status code on array {extensions} parameter
        -Response body execution result has a property "errors" +Response status code is not 400 
        {
   "statusText": "OK",
   "status": 200,
@@ -1338,7 +1338,7 @@ The server MUST support these.
        9. -
      9. 0222 MUST allow null {extensions} parameter when accepting application/json +
      10. 1B7A MUST allow map {extensions} parameter when accepting application/json
        Response body execution result has a property "errors" 
        {
@@ -1372,9 +1372,9 @@ The server MUST support these.
        11. -
      11. 28B9 MUST allow map {variables} parameter when accepting application/json +
      12. 865D MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
        -Response body execution result has a property "errors" +Response status is not between 400 and 599 
        {
   "statusText": "OK",
   "status": 200,
@@ -1406,9 +1406,9 @@ The server MUST support these.
        13. -
      13. 1B7A MUST allow map {extensions} parameter when accepting application/json +
      14. 51FE MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
        -Response body execution result has a property "errors" +Response status is not between 400 and 599 
        {
   "statusText": "OK",
   "status": 200,
diff --git a/implementations/thegraph/report.json b/implementations/thegraph/report.json
index 22374362..13fd278b 100644
--- a/implementations/thegraph/report.json
+++ b/implementations/thegraph/report.json
@@ -1,7 +1,7 @@
 {
   "total": 60,
   "ok": 19,
-  "notice": 25,
-  "warn": 9,
-  "error": 7
+  "notice": 21,
+  "warn": 3,
+  "error": 17
 }

From 2aae445070c877d9d55daa466cc15809b5c60f1f Mon Sep 17 00:00:00 2001
From: Denis Badurina 
Date: Thu, 23 Jan 2025 17:21:56 +0100
Subject: [PATCH 3/6] validation error audits

---
 src/audits/server.ts | 51 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 48 insertions(+), 3 deletions(-)

diff --git a/src/audits/server.ts b/src/audits/server.ts
index 702acc20..739a059e 100644
--- a/src/audits/server.ts
+++ b/src/audits/server.ts
@@ -491,24 +491,69 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] {
         await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
       },
     ),
+    ...['string', 0, false, ['array']].map((invalid, index) =>
+      audit(
+        `028${index}`,
+        `MUST use 4xx or 5xx status codes on ${extendedTypeof(
+          invalid,
+        )} {extensions} parameter when accepting application/graphql-response+json`,
+        async () => {
+          const res = await fetchFn(await getUrl(opts.url), {
+            method: 'POST',
+            headers: {
+              'content-type': 'application/json',
+              accept: 'application/graphql-response+json',
+            },
+            body: JSON.stringify({
+              query: '{ __typename }',
+              extensions: invalid,
+            }),
+          });
+          ressert(res).status.toBeBetween(400, 599);
+        },
+      ),
+    ),
+    ...['string', 0, false, ['array']].map((invalid, index) =>
+      audit(
+        `233${index}`,
+        `SHOULD use 4xx status code on ${extendedTypeof(
+          invalid,
+        )} {extensions} parameter when accepting application/graphql-response+json`,
+        async () => {
+          const res = await fetchFn(await getUrl(opts.url), {
+            method: 'POST',
+            headers: {
+              'content-type': 'application/json',
+              accept: 'application/graphql-response+json',
+            },
+            body: JSON.stringify({
+              query: '{ __typename }',
+              extensions: invalid,
+            }),
+          });
+          ressert(res).status.toBeBetween(400, 499);
+        },
+      ),
+    ),
     ...['string', 0, false, ['array']].map((invalid, index) =>
       audit(
         `58B${index}`,
-        `MUST use 400 status code on ${extendedTypeof(
+        `SHOULD use 4xx or 5xx status codes on ${extendedTypeof(
           invalid,
-        )} {extensions} parameter`,
+        )} {extensions} parameter when accepting application/json`,
         async () => {
           const res = await fetchFn(await getUrl(opts.url), {
             method: 'POST',
             headers: {
               'content-type': 'application/json',
+              accept: 'application/json',
             },
             body: JSON.stringify({
               query: '{ __typename }',
               extensions: invalid,
             }),
           });
-          ressert(res).status.toBe(400);
+          ressert(res).status.toBeBetween(400, 599);
         },
       ),
     ),

From 55e8a815180bcd2f9e8d897917262ccf3ea2aa50 Mon Sep 17 00:00:00 2001
From: theguild-bot 
Date: Thu, 23 Jan 2025 16:24:51 +0000
Subject: [PATCH 4/6] docs(implementations): audit report

---
 implementations/apollo-server/README.md     |  20 +-
 implementations/apollo-server/report.json   |   4 +-
 implementations/deno/README.md              | 192 +++++++------
 implementations/deno/report.json            |   8 +-
 implementations/express-graphql/README.md   | 212 +++++++++++++-
 implementations/express-graphql/report.json |   4 +-
 implementations/graph-client/README.md      |  20 +-
 implementations/graph-client/report.json    |   4 +-
 implementations/graphql-helix/README.md     | 204 +++++++++++++-
 implementations/graphql-helix/report.json   |   4 +-
 implementations/graphql-yoga/README.md      |  20 +-
 implementations/graphql-yoga/report.json    |   4 +-
 implementations/hotchocolate/README.md      | 146 +++++++++-
 implementations/hotchocolate/report.json    |   6 +-
 implementations/lighthouse/README.md        | 204 +++++++++++++-
 implementations/lighthouse/report.json      |   4 +-
 implementations/mercurius/README.md         |  20 +-
 implementations/mercurius/report.json       |   4 +-
 implementations/postgraphile/README.md      | 196 ++++++++++++-
 implementations/postgraphile/report.json    |   4 +-
 implementations/thegraph/README.md          | 292 +++++++++++++++++++-
 implementations/thegraph/report.json        |   4 +-
 22 files changed, 1378 insertions(+), 198 deletions(-)

diff --git a/implementations/apollo-server/README.md b/implementations/apollo-server/README.md
index 8f4cdacd..5ac5e89d 100644
--- a/implementations/apollo-server/README.md
+++ b/implementations/apollo-server/README.md
@@ -3,8 +3,8 @@
 
        GraphQL over HTTP audit report
        
 
 
          
-
        • 60 audits in total
          • 
-
        • ✅ 54 pass
          • 
+
        • 68 audits in total
          • 
+
        • ✅ 62 pass
          • 
 
        • 💡 3 notices (suggestions)
          • 
 
        • ❗️ 3 warnings (optional)
          • 
 
        
@@ -48,10 +48,18 @@
 
      15. 4763 MAY use 400 status code on array {variables} parameter
        16. 
 
      16. 2EA1 MUST allow map {variables} parameter when accepting application/graphql-response+json
        17. 
 
      17. 28B9 MUST allow map {variables} parameter when accepting application/json
        18. 
-
      18. 58B0 MUST use 400 status code on string {extensions} parameter
        19. 
-
      19. 58B1 MUST use 400 status code on number {extensions} parameter
        20. 
-
      20. 58B2 MUST use 400 status code on boolean {extensions} parameter
        21. 
-
      21. 58B3 MUST use 400 status code on array {extensions} parameter
        22. 
+
      22. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
        23. 
+
      23. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
        24. 
+
      24. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
        25. 
+
      25. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
        26. 
+
      26. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
        27. 
+
      27. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
        28. 
+
      28. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
        29. 
+
      29. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
        30. 
+
      30. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
        31. 
+
      31. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
        32. 
+
      32. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
        33. 
+
      33. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
        34. 
 
      34. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
        35. 
 
      35. 1B7A MUST allow map {extensions} parameter when accepting application/json
        36. 
 
      36. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
        37. 
diff --git a/implementations/apollo-server/report.json b/implementations/apollo-server/report.json
index 2476acfc..c5c3d982 100644
--- a/implementations/apollo-server/report.json
+++ b/implementations/apollo-server/report.json
@@ -1,6 +1,6 @@
 {
-  "total": 60,
-  "ok": 54,
+  "total": 68,
+  "ok": 62,
   "notice": 3,
   "warn": 3,
   "error": 0
diff --git a/implementations/deno/README.md b/implementations/deno/README.md
index 2b841a92..a8cd49c1 100644
--- a/implementations/deno/README.md
+++ b/implementations/deno/README.md
@@ -3,11 +3,11 @@
 
        GraphQL over HTTP audit report
        
 
 
          
-
        • 60 audits in total
          • 
-
        • ✅ 29 pass
          • 
+
        • 68 audits in total
          • 
+
        • ✅ 37 pass
          • 
 
        • 💡 14 notices (suggestions)
          • 
-
        • ❗️ 5 warnings (optional)
          • 
-
        • ❌ 12 errors (required)
          • 
+
        • ❗️ 9 warnings (optional)
          • 
+
        • ❌ 8 errors (required)
          • 
 
        
 
 
        Passing
        
@@ -33,6 +33,14 @@
 
      37. 4761 MAY use 400 status code on number {variables} parameter
        38. 
 
      38. 4762 MAY use 400 status code on boolean {variables} parameter
        39. 
 
      39. 28B9 MUST allow map {variables} parameter when accepting application/json
        40. 
+
      40. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
        41. 
+
      41. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
        42. 
+
      42. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
        43. 
+
      43. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
        44. 
+
      44. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
        45. 
+
      45. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
        46. 
+
      46. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
        47. 
+
      47. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
        48. 
 
      48. 1B7A MUST allow map {extensions} parameter when accepting application/json
        49. 
 
      49. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
        50. 
 
      50. BCF8 MAY use 400 status code on JSON parsing failure
        51. 
@@ -365,6 +373,94 @@ The server MAY support these, but are truly optional. These are suggestio
 
        Warnings
        
 The server SHOULD support these, but is not required.
 
          
+
        1. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
+
          
+Response status is not between 400 and 599
+
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          
+
          
+
          2. 
+
        2. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
+
          
+Response status is not between 400 and 599
+
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          
+
          
+
          3. 
+
        3. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
+
          
+Response status is not between 400 and 599
+
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          
+
          
+
          4. 
+
        4. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
+
          
+Response status is not between 400 and 599
+
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "59",
+    "content-encoding": "gzip"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          
+
          
+
          5. 
 
        5. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
 
          
 Response status code is not 400
@@ -574,94 +670,6 @@ The server MUST support these.
        51. -
      51. 58B0 MUST use 400 status code on string {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "vary": "Accept-Encoding",
-    "date": "",
-    "content-type": "application/json",
-    "content-length": "59",
-    "content-encoding": "gzip"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        52. -
      52. 58B1 MUST use 400 status code on number {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "vary": "Accept-Encoding",
-    "date": "",
-    "content-type": "application/json",
-    "content-length": "59",
-    "content-encoding": "gzip"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        53. -
      53. 58B2 MUST use 400 status code on boolean {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "vary": "Accept-Encoding",
-    "date": "",
-    "content-type": "application/json",
-    "content-length": "59",
-    "content-encoding": "gzip"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
        54. -
      54. 58B3 MUST use 400 status code on array {extensions} parameter -
        -Response status code is not 400 -
        {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "vary": "Accept-Encoding",
-    "date": "",
-    "content-type": "application/json",
-    "content-length": "59",
-    "content-encoding": "gzip"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
        -
        -
      55. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
        Response status code is not 200 diff --git a/implementations/deno/report.json b/implementations/deno/report.json index 2422feeb..41591878 100644 --- a/implementations/deno/report.json +++ b/implementations/deno/report.json @@ -1,7 +1,7 @@ { - "total": 60, - "ok": 29, + "total": 68, + "ok": 37, "notice": 14, - "warn": 5, - "error": 12 + "warn": 9, + "error": 8 } diff --git a/implementations/express-graphql/README.md b/implementations/express-graphql/README.md index 2b646c62..7cc3be99 100644 --- a/implementations/express-graphql/README.md +++ b/implementations/express-graphql/README.md @@ -3,10 +3,10 @@

        GraphQL over HTTP audit report

          -
        • 60 audits in total
          • +
        • 68 audits in total
        • ✅ 45 pass
        • 💡 7 notices (suggestions)
          • -
        • ❗️ 3 warnings (optional)
          • +
        • ❗️ 11 warnings (optional)
        • ❌ 5 errors (required)
        @@ -235,6 +235,198 @@ The server MAY support these, but are truly optional. These are suggestio

        Warnings

        The server SHOULD support these, but is not required.
          +
        1. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          2. +
        2. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          3. +
        3. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          4. +
        4. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          5. +
        5. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          6. +
        6. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          7. +
        7. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          8. +
        8. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "etag": "W/\"1f-yOwhVHjWKeagyuteVuktj+6mcMg\"",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
        9. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
          Response status code is not 200 @@ -369,9 +561,9 @@ The server MUST support these.
          10. -
        10. 58B0 MUST use 400 status code on string {extensions} parameter +
        11. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -393,9 +585,9 @@ The server MUST support these.
          12. -
        12. 58B1 MUST use 400 status code on number {extensions} parameter +
        13. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -417,9 +609,9 @@ The server MUST support these.
          14. -
        14. 58B2 MUST use 400 status code on boolean {extensions} parameter +
        15. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -441,9 +633,9 @@ The server MUST support these.
          16. -
        16. 58B3 MUST use 400 status code on array {extensions} parameter +
        17. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
diff --git a/implementations/express-graphql/report.json b/implementations/express-graphql/report.json
index 03056bbe..7f98e925 100644
--- a/implementations/express-graphql/report.json
+++ b/implementations/express-graphql/report.json
@@ -1,7 +1,7 @@
 {
-  "total": 60,
+  "total": 68,
   "ok": 45,
   "notice": 7,
-  "warn": 3,
+  "warn": 11,
   "error": 5
 }
diff --git a/implementations/graph-client/README.md b/implementations/graph-client/README.md
index cac189ac..531a36cc 100644
--- a/implementations/graph-client/README.md
+++ b/implementations/graph-client/README.md
@@ -3,8 +3,8 @@
 
          GraphQL over HTTP audit report
          
 
 
            
-
          • 60 audits in total
            • 
-
          • ✅ 57 pass
            • 
+
          • 68 audits in total
            • 
+
          • ✅ 65 pass
            • 
 
          • 💡 3 notices (suggestions)
            • 
 
          
 
@@ -49,10 +49,18 @@
 
        18. 28B9 MUST allow map {variables} parameter when accepting application/json
          19. 
 
        19. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
          20. 
 
        20. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
          21. 
-
        21. 58B0 MUST use 400 status code on string {extensions} parameter
          22. 
-
        22. 58B1 MUST use 400 status code on number {extensions} parameter
          23. 
-
        23. 58B2 MUST use 400 status code on boolean {extensions} parameter
          24. 
-
        24. 58B3 MUST use 400 status code on array {extensions} parameter
          25. 
+
        25. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          26. 
+
        26. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          27. 
+
        27. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          28. 
+
        28. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          29. 
+
        29. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
          30. 
+
        30. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
          31. 
+
        31. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
          32. 
+
        32. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
          33. 
+
        33. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
          34. 
+
        34. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
          35. 
+
        35. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
          36. 
+
        36. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
          37. 
 
        37. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
          38. 
 
        38. 1B7A MUST allow map {extensions} parameter when accepting application/json
          39. 
 
        39. 8764 MAY use 4xx or 5xx status codes if parameters are invalid
          40. 
diff --git a/implementations/graph-client/report.json b/implementations/graph-client/report.json
index 17ae4227..ab91c153 100644
--- a/implementations/graph-client/report.json
+++ b/implementations/graph-client/report.json
@@ -1,6 +1,6 @@
 {
-  "total": 60,
-  "ok": 57,
+  "total": 68,
+  "ok": 65,
   "notice": 3,
   "warn": 0,
   "error": 0
diff --git a/implementations/graphql-helix/README.md b/implementations/graphql-helix/README.md
index 46ce3ddc..c3366b42 100644
--- a/implementations/graphql-helix/README.md
+++ b/implementations/graphql-helix/README.md
@@ -3,10 +3,10 @@
 
          GraphQL over HTTP audit report
          
 
 
            
-
          • 60 audits in total
            • 
+
          • 68 audits in total
            • 
 
          • ✅ 49 pass
            • 
 
          • 💡 3 notices (suggestions)
            • 
-
          • ❗️ 3 warnings (optional)
            • 
+
          • ❗️ 11 warnings (optional)
            • 
 
          • ❌ 5 errors (required)
            • 
 
          
 
@@ -140,6 +140,190 @@ The server MAY support these, but are truly optional. These are suggestio
 
          Warnings
          
 The server SHOULD support these, but is not required.
 
            
+
          1. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            2. 
+
          2. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            3. 
+
          3. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            4. 
+
          4. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            5. 
+
          5. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            6. 
+
          6. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            7. 
+
          7. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            8. 
+
          8. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "Express",
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
            
+
            
+
            9. 
 
          9. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
 
            
 Response status code is not 200
@@ -270,9 +454,9 @@ The server MUST support these.
          40. -
        40. 58B0 MUST use 400 status code on string {extensions} parameter +
        41. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -293,9 +477,9 @@ The server MUST support these.
          42. -
        42. 58B1 MUST use 400 status code on number {extensions} parameter +
        43. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -316,9 +500,9 @@ The server MUST support these.
          44. -
        44. 58B2 MUST use 400 status code on boolean {extensions} parameter +
        45. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -339,9 +523,9 @@ The server MUST support these.
          46. -
        46. 58B3 MUST use 400 status code on array {extensions} parameter +
        47. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
diff --git a/implementations/graphql-helix/report.json b/implementations/graphql-helix/report.json
index 3d69c639..36eb9d6f 100644
--- a/implementations/graphql-helix/report.json
+++ b/implementations/graphql-helix/report.json
@@ -1,7 +1,7 @@
 {
-  "total": 60,
+  "total": 68,
   "ok": 49,
   "notice": 3,
-  "warn": 3,
+  "warn": 11,
   "error": 5
 }
diff --git a/implementations/graphql-yoga/README.md b/implementations/graphql-yoga/README.md
index 7555d3f0..21cf804b 100644
--- a/implementations/graphql-yoga/README.md
+++ b/implementations/graphql-yoga/README.md
@@ -3,8 +3,8 @@
 
          GraphQL over HTTP audit report
          
 
 
            
-
          • 60 audits in total
            • 
-
          • ✅ 60 pass
            • 
+
          • 68 audits in total
            • 
+
          • ✅ 68 pass
            • 
 
          
 
 
          Passing
          
@@ -49,10 +49,18 @@
 
        48. 28B9 MUST allow map {variables} parameter when accepting application/json
          49. 
 
        49. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
          50. 
 
        50. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
          51. 
-
        51. 58B0 MUST use 400 status code on string {extensions} parameter
          52. 
-
        52. 58B1 MUST use 400 status code on number {extensions} parameter
          53. 
-
        53. 58B2 MUST use 400 status code on boolean {extensions} parameter
          54. 
-
        54. 58B3 MUST use 400 status code on array {extensions} parameter
          55. 
+
        55. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          56. 
+
        56. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          57. 
+
        57. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          58. 
+
        58. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          59. 
+
        59. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
          60. 
+
        60. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
          61. 
+
        61. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
          62. 
+
        62. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
          63. 
+
        63. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
          64. 
+
        64. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
          65. 
+
        65. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
          66. 
+
        66. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
          67. 
 
        67. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
          68. 
 
        68. 1B7A MUST allow map {extensions} parameter when accepting application/json
          69. 
 
        69. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
          70. 
diff --git a/implementations/graphql-yoga/report.json b/implementations/graphql-yoga/report.json
index d19c440b..562cbede 100644
--- a/implementations/graphql-yoga/report.json
+++ b/implementations/graphql-yoga/report.json
@@ -1,6 +1,6 @@
 {
-  "total": 60,
-  "ok": 60,
+  "total": 68,
+  "ok": 68,
   "notice": 0,
   "warn": 0,
   "error": 0
diff --git a/implementations/hotchocolate/README.md b/implementations/hotchocolate/README.md
index 902cd383..6a1205c1 100644
--- a/implementations/hotchocolate/README.md
+++ b/implementations/hotchocolate/README.md
@@ -3,9 +3,9 @@
 
          GraphQL over HTTP audit report
          
 
 
            
-
          • 60 audits in total
            • 
-
          • ✅ 58 pass
            • 
-
          • ❗️ 2 warnings (optional)
            • 
+
          • 68 audits in total
            • 
+
          • ✅ 62 pass
            • 
+
          • ❗️ 6 warnings (optional)
            • 
 
          
 
 
          Passing
          
@@ -48,10 +48,14 @@
 
        70. 28B9 MUST allow map {variables} parameter when accepting application/json
          71. 
 
        71. D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
          72. 
 
        72. 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
          73. 
-
        73. 58B0 MUST use 400 status code on string {extensions} parameter
          74. 
-
        74. 58B1 MUST use 400 status code on number {extensions} parameter
          75. 
-
        75. 58B2 MUST use 400 status code on boolean {extensions} parameter
          76. 
-
        76. 58B3 MUST use 400 status code on array {extensions} parameter
          77. 
+
        77. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          78. 
+
        78. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          79. 
+
        79. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          80. 
+
        80. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          81. 
+
        81. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
          82. 
+
        82. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
          83. 
+
        83. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
          84. 
+
        84. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
          85. 
 
        85. 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
          86. 
 
        86. 1B7A MUST allow map {extensions} parameter when accepting application/json
          87. 
 
        87. B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
          88. 
@@ -115,5 +119,133 @@ The server SHOULD support these, but is not required.
          88. +
        88. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "transfer-encoding": "chunked",
+    "server": "Kestrel",
+    "date": "",
+    "content-type": "application/json; charset=utf-8"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Expected an object or a null-token, but found a String-token with value `string`.",
+        "locations": [
+          {
+            "line": 1,
+            "column": 40
+          }
+        ],
+        "extensions": {
+          "code": "HC0011"
+        }
+      }
+    ]
+  }
+}
+
          +
          +
          89. +
        89. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "transfer-encoding": "chunked",
+    "server": "Kestrel",
+    "date": "",
+    "content-type": "application/json; charset=utf-8"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Expected an object or a null-token, but found a Integer-token with value `0`.",
+        "locations": [
+          {
+            "line": 1,
+            "column": 40
+          }
+        ],
+        "extensions": {
+          "code": "HC0011"
+        }
+      }
+    ]
+  }
+}
+
          +
          +
          90. +
        90. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "transfer-encoding": "chunked",
+    "server": "Kestrel",
+    "date": "",
+    "content-type": "application/json; charset=utf-8"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Expected an object or a null-token, but found a Name-token with value `false`.",
+        "locations": [
+          {
+            "line": 1,
+            "column": 40
+          }
+        ],
+        "extensions": {
+          "code": "HC0011"
+        }
+      }
+    ]
+  }
+}
+
          +
          +
          91. +
        91. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "transfer-encoding": "chunked",
+    "server": "Kestrel",
+    "date": "",
+    "content-type": "application/json; charset=utf-8"
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "Expected an object or a null-token, but found a LeftBracket-token with value ``.",
+        "locations": [
+          {
+            "line": 1,
+            "column": 40
+          }
+        ],
+        "extensions": {
+          "code": "HC0011"
+        }
+      }
+    ]
+  }
+}
+
          +
          +
        diff --git a/implementations/hotchocolate/report.json b/implementations/hotchocolate/report.json index ddfc3f4e..05a4235b 100644 --- a/implementations/hotchocolate/report.json +++ b/implementations/hotchocolate/report.json @@ -1,7 +1,7 @@ { - "total": 60, - "ok": 58, + "total": 68, + "ok": 62, "notice": 0, - "warn": 2, + "warn": 6, "error": 0 } diff --git a/implementations/lighthouse/README.md b/implementations/lighthouse/README.md index fb3ce764..0e8f3536 100644 --- a/implementations/lighthouse/README.md +++ b/implementations/lighthouse/README.md @@ -3,10 +3,10 @@

        GraphQL over HTTP audit report

          -
        • 60 audits in total
          • +
        • 68 audits in total
        • ✅ 33 pass
        • 💡 17 notices (suggestions)
          • -
        • ❗️ 3 warnings (optional)
          • +
        • ❗️ 11 warnings (optional)
        • ❌ 7 errors (required)
        @@ -4089,6 +4089,190 @@ The server MAY support these, but are truly optional. These are suggestio

        Warnings

        The server SHOULD support these, but is not required.
          +
        1. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          2. +
        2. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          3. +
        3. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          4. +
        4. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json +
          +Response status is not between 400 and 499 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          5. +
        5. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          6. +
        6. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          7. +
        7. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
          8. +
        8. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json +
          +Response status is not between 400 and 599 +
          {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "x-powered-by": "PHP/8.2.19",
+    "host": "localhost:4000",
+    "date": "",
+    "content-type": "application/json",
+    "connection": "close",
+    "cache-control": "no-cache, private"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
          +
          +
        9. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
          Response status code is not 400 @@ -4222,9 +4406,9 @@ The server MUST support these.
          10. -
        10. 58B0 MUST use 400 status code on string {extensions} parameter +
        11. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -4245,9 +4429,9 @@ The server MUST support these.
          12. -
        12. 58B1 MUST use 400 status code on number {extensions} parameter +
        13. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -4268,9 +4452,9 @@ The server MUST support these.
          14. -
        14. 58B2 MUST use 400 status code on boolean {extensions} parameter +
        15. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -4291,9 +4475,9 @@ The server MUST support these.
          16. -
        16. 58B3 MUST use 400 status code on array {extensions} parameter +
        17. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
diff --git a/implementations/lighthouse/report.json b/implementations/lighthouse/report.json
index f74b313c..650ecfcb 100644
--- a/implementations/lighthouse/report.json
+++ b/implementations/lighthouse/report.json
@@ -1,7 +1,7 @@
 {
-  "total": 60,
+  "total": 68,
   "ok": 33,
   "notice": 17,
-  "warn": 3,
+  "warn": 11,
   "error": 7
 }
diff --git a/implementations/mercurius/README.md b/implementations/mercurius/README.md
index 2373a8e6..f348a0df 100644
--- a/implementations/mercurius/README.md
+++ b/implementations/mercurius/README.md
@@ -3,8 +3,8 @@
 
          GraphQL over HTTP audit report
          
 
 
            
-
          • 60 audits in total
            • 
-
          • ✅ 46 pass
            • 
+
          • 68 audits in total
            • 
+
          • ✅ 54 pass
            • 
 
          • 💡 6 notices (suggestions)
            • 
 
          • ❗️ 5 warnings (optional)
            • 
 
          • ❌ 3 errors (required)
            • 
@@ -43,10 +43,18 @@
 
          • 28B9 MUST allow map {variables} parameter when accepting application/json
            • 
 
          • D6D5 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json
            • 
 
          • 6A70 MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json
            • 
-
          • 58B0 MUST use 400 status code on string {extensions} parameter
            • 
-
          • 58B1 MUST use 400 status code on number {extensions} parameter
            • 
-
          • 58B2 MUST use 400 status code on boolean {extensions} parameter
            • 
-
          • 58B3 MUST use 400 status code on array {extensions} parameter
            • 
+
          • 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
            • 
+
          • 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
            • 
+
          • 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
            • 
+
          • 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
            • 
+
          • 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
            • 
 
          • 428F MUST allow map {extensions} parameter when accepting application/graphql-response+json
            • 
 
          • 1B7A MUST allow map {extensions} parameter when accepting application/json
            • 
 
          • B6DC MAY use 4xx or 5xx status codes on JSON parsing failure
            • 
diff --git a/implementations/mercurius/report.json b/implementations/mercurius/report.json
index f1686007..6c3bb880 100644
--- a/implementations/mercurius/report.json
+++ b/implementations/mercurius/report.json
@@ -1,6 +1,6 @@
 {
-  "total": 60,
-  "ok": 46,
+  "total": 68,
+  "ok": 54,
   "notice": 6,
   "warn": 5,
   "error": 3
diff --git a/implementations/postgraphile/README.md b/implementations/postgraphile/README.md
index 66ad52c4..6dce9207 100644
--- a/implementations/postgraphile/README.md
+++ b/implementations/postgraphile/README.md
@@ -3,10 +3,10 @@
 
            GraphQL over HTTP audit report
            
 
 
              
-
            • 60 audits in total
              • 
+
            • 68 audits in total
              • 
 
            • ✅ 46 pass
              • 
 
            • 💡 6 notices (suggestions)
              • 
-
            • ❗️ 3 warnings (optional)
              • 
+
            • ❗️ 11 warnings (optional)
              • 
 
            • ❌ 5 errors (required)
              • 
 
            
 
@@ -213,6 +213,182 @@ The server MAY support these, but are truly optional. These are suggestio
 
            Warnings
            
 The server SHOULD support these, but is not required.
 
              
+
            1. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
+
              
+Response status is not between 400 and 499
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              2. 
+
            2. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
+
              
+Response status is not between 400 and 499
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              3. 
+
            3. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
+
              
+Response status is not between 400 and 499
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              4. 
+
            4. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
+
              
+Response status is not between 400 and 499
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              5. 
+
            5. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
+
              
+Response status is not between 400 and 599
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              6. 
+
            6. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
+
              
+Response status is not between 400 and 599
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              7. 
+
            7. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
+
              
+Response status is not between 400 and 599
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              8. 
+
            8. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
+
              
+Response status is not between 400 and 599
+
              {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "keep-alive": "timeout=5",
+    "date": "",
+    "content-type": "application/json; charset=utf-8",
+    "content-length": "31",
+    "connection": "keep-alive"
+  },
+  "body": {
+    "data": {
+      "__typename": "Query"
+    }
+  }
+}
+
              
+
              
+
              9. 
 
            9. 572B SHOULD use 200 status code on document parsing failure when accepting application/json
 
              
 Response status code is not 200
@@ -330,9 +506,9 @@ The server MUST support these.
          18. -
        18. 58B0 MUST use 400 status code on string {extensions} parameter +
        19. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -352,9 +528,9 @@ The server MUST support these.
          20. -
        20. 58B1 MUST use 400 status code on number {extensions} parameter +
        21. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -374,9 +550,9 @@ The server MUST support these.
          22. -
        22. 58B2 MUST use 400 status code on boolean {extensions} parameter +
        23. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -396,9 +572,9 @@ The server MUST support these.
          24. -
        24. 58B3 MUST use 400 status code on array {extensions} parameter +
        25. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
diff --git a/implementations/postgraphile/report.json b/implementations/postgraphile/report.json
index f325f96c..25383d18 100644
--- a/implementations/postgraphile/report.json
+++ b/implementations/postgraphile/report.json
@@ -1,7 +1,7 @@
 {
-  "total": 60,
+  "total": 68,
   "ok": 46,
   "notice": 6,
-  "warn": 3,
+  "warn": 11,
   "error": 5
 }
diff --git a/implementations/thegraph/README.md b/implementations/thegraph/README.md
index d321ef68..9cf16268 100644
--- a/implementations/thegraph/README.md
+++ b/implementations/thegraph/README.md
@@ -3,10 +3,10 @@
 
          GraphQL over HTTP audit report
          
 
 
            
-
          • 60 audits in total
            • 
+
          • 68 audits in total
            • 
 
          • ✅ 19 pass
            • 
 
          • 💡 21 notices (suggestions)
            • 
-
          • ❗️ 3 warnings (optional)
            • 
+
          • ❗️ 11 warnings (optional)
            • 
 
          • ❌ 17 errors (required)
            • 
 
          
 
@@ -755,6 +755,278 @@ The server MAY support these, but are truly optional. These are suggestio
 
          Warnings
          
 The server SHOULD support these, but is not required.
 
            
+
          1. 2330 SHOULD use 4xx status code on string {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            2. 
+
          2. 2331 SHOULD use 4xx status code on number {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            3. 
+
          3. 2332 SHOULD use 4xx status code on boolean {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            4. 
+
          4. 2333 SHOULD use 4xx status code on array {extensions} parameter when accepting application/graphql-response+json
+
            
+Response status is not between 400 and 499
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            5. 
+
          5. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            6. 
+
          6. 58B1 SHOULD use 4xx or 5xx status codes on number {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            7. 
+
          7. 58B2 SHOULD use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            8. 
+
          8. 58B3 SHOULD use 4xx or 5xx status codes on array {extensions} parameter when accepting application/json
+
            
+Response status is not between 400 and 599
+
            {
+  "statusText": "OK",
+  "status": 200,
+  "headers": {
+    "vary": "Accept-Encoding",
+    "transfer-encoding": "chunked",
+    "set-cookie": "",
+    "server": "cloudflare",
+    "last-modified": "Mon, 02 Dec 2024 20:56:39 GMT",
+    "expires": "",
+    "etag": "W/\"cffa996b9fb9470d034909269c4d8d0f\"",
+    "date": "",
+    "content-type": "application/json",
+    "content-encoding": "br",
+    "connection": "keep-alive",
+    "cf-ray": "",
+    "cf-cache-status": "HIT",
+    "cache-control": "public, max-age=3600",
+    "age": ""
+  },
+  "body": {
+    "errors": [
+      {
+        "message": "This endpoint has been removed. If you have any questions, reach out to support@thegraph.zendesk.com"
+      }
+    ]
+  }
+}
+
            
+
            
+
            9. 
 
          9. 556A SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
 
            
 Response status code is not 400
@@ -1202,9 +1474,9 @@ The server MUST support these.
          26. -
        26. 58B0 MUST use 400 status code on string {extensions} parameter +
        27. 0280 MUST use 4xx or 5xx status codes on string {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -1236,9 +1508,9 @@ The server MUST support these.
          28. -
        28. 58B1 MUST use 400 status code on number {extensions} parameter +
        29. 0281 MUST use 4xx or 5xx status codes on number {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -1270,9 +1542,9 @@ The server MUST support these.
          30. -
        30. 58B2 MUST use 400 status code on boolean {extensions} parameter +
        31. 0282 MUST use 4xx or 5xx status codes on boolean {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
@@ -1304,9 +1576,9 @@ The server MUST support these.
          32. -
        32. 58B3 MUST use 400 status code on array {extensions} parameter +
        33. 0283 MUST use 4xx or 5xx status codes on array {extensions} parameter when accepting application/graphql-response+json
          -Response status code is not 400 +Response status is not between 400 and 599 
          {
   "statusText": "OK",
   "status": 200,
diff --git a/implementations/thegraph/report.json b/implementations/thegraph/report.json
index 13fd278b..553c5b64 100644
--- a/implementations/thegraph/report.json
+++ b/implementations/thegraph/report.json
@@ -1,7 +1,7 @@
 {
-  "total": 60,
+  "total": 68,
   "ok": 19,
   "notice": 21,
-  "warn": 3,
+  "warn": 11,
   "error": 17
 }

From 2bcb175d4ff087fe0a43aaf216114a080e002971 Mon Sep 17 00:00:00 2001
From: Denis Badurina 
Date: Thu, 23 Jan 2025 17:31:07 +0100
Subject: [PATCH 5/6] one or the other works

---
 src/audits/server.ts | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/audits/server.ts b/src/audits/server.ts
index 739a059e..77551396 100644
--- a/src/audits/server.ts
+++ b/src/audits/server.ts
@@ -75,7 +75,7 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] {
     ),
     audit(
       '47DE',
-      'SHOULD accept */* and use application/json for the content-type',
+      'SHOULD accept */* and use application/graphql-response+json or application/json for the content-type',
       async () => {
         const res = await fetchFn(await getUrl(opts.url), {
           method: 'POST',
@@ -86,12 +86,18 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] {
           body: JSON.stringify({ query: '{ __typename }' }),
         });
         ressert(res).status.toBe(200);
-        ressert(res).header('content-type').toContain('application/json');
+        try {
+          ressert(res)
+            .header('content-type')
+            .toContain('application/graphql-response+json');
+        } catch {
+          ressert(res).header('content-type').toContain('application/json');
+        }
       },
     ),
     audit(
       '80D8',
-      'SHOULD assume application/json content-type when accept is missing',
+      'SHOULD assume application/json or application/graphql-response+json content-type when accept is missing',
       async () => {
         const res = await fetchFn(await getUrl(opts.url), {
           method: 'POST',
@@ -102,7 +108,13 @@ export function serverAudits(opts: ServerAuditOptions): Audit[] {
         });
 
         ressert(res).status.toBe(200);
-        ressert(res).header('content-type').toContain('application/json');
+        try {
+          ressert(res)
+            .header('content-type')
+            .toContain('application/graphql-response+json');
+        } catch {
+          ressert(res).header('content-type').toContain('application/json');
+        }
       },
     ),
     audit('82A3', 'MUST use utf-8 encoding when responding', async () => {

From 6aa2a57017128cb635a911fb8f547a60f1caa808 Mon Sep 17 00:00:00 2001
From: theguild-bot 
Date: Thu, 23 Jan 2025 16:33:28 +0000
Subject: [PATCH 6/6] docs(implementations): audit report

---
 implementations/apollo-server/README.md   |  4 +-
 implementations/deno/README.md            |  4 +-
 implementations/express-graphql/README.md |  4 +-
 implementations/graph-client/README.md    |  4 +-
 implementations/graphql-helix/README.md   |  4 +-
 implementations/graphql-yoga/README.md    |  4 +-
 implementations/hotchocolate/README.md    | 48 ++---------------------
 implementations/hotchocolate/report.json  |  4 +-
 implementations/lighthouse/README.md      |  4 +-
 implementations/mercurius/README.md       |  4 +-
 implementations/postgraphile/README.md    |  4 +-
 implementations/thegraph/README.md        |  4 +-
 12 files changed, 26 insertions(+), 66 deletions(-)

diff --git a/implementations/apollo-server/README.md b/implementations/apollo-server/README.md
index 5ac5e89d..902516cc 100644
--- a/implementations/apollo-server/README.md
+++ b/implementations/apollo-server/README.md
@@ -13,8 +13,8 @@
 
            
 
          1. 22EB MUST accept application/graphql-response+json and match the content-type
            2. 
 
          2. 4655 MUST accept application/json and match the content-type
            3. 
-
          3. 47DE SHOULD accept */* and use application/json for the content-type
            4. 
-
          4. 80D8 SHOULD assume application/json content-type when accept is missing
            5. 
+
          5. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
            6. 
+
          6. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
            7. 
 
          7. 82A3 MUST use utf-8 encoding when responding
            8. 
 
          8. BF61 MUST accept utf-8 encoded request
            9. 
 
          9. 78D5 MUST assume utf-8 in request if encoding is unspecified
            10. 
diff --git a/implementations/deno/README.md b/implementations/deno/README.md
index a8cd49c1..7d457a37 100644
--- a/implementations/deno/README.md
+++ b/implementations/deno/README.md
@@ -13,8 +13,8 @@
 
            Passing
            
 
              
 
            1. 4655 MUST accept application/json and match the content-type
              2. 
-
            2. 47DE SHOULD accept */* and use application/json for the content-type
              3. 
-
            3. 80D8 SHOULD assume application/json content-type when accept is missing
              4. 
+
            4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
              5. 
+
            5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
              6. 
 
            6. 82A3 MUST use utf-8 encoding when responding
              7. 
 
            7. BF61 MUST accept utf-8 encoded request
              8. 
 
            8. 78D5 MUST assume utf-8 in request if encoding is unspecified
              9. 
diff --git a/implementations/express-graphql/README.md b/implementations/express-graphql/README.md
index 7cc3be99..317b1962 100644
--- a/implementations/express-graphql/README.md
+++ b/implementations/express-graphql/README.md
@@ -13,8 +13,8 @@
 
              Passing
              
 
                
 
              1. 4655 MUST accept application/json and match the content-type
                2. 
-
              2. 47DE SHOULD accept */* and use application/json for the content-type
                3. 
-
              3. 80D8 SHOULD assume application/json content-type when accept is missing
                4. 
+
              4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                5. 
+
              5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                6. 
 
              6. 82A3 MUST use utf-8 encoding when responding
                7. 
 
              7. BF61 MUST accept utf-8 encoded request
                8. 
 
              8. 78D5 MUST assume utf-8 in request if encoding is unspecified
                9. 
diff --git a/implementations/graph-client/README.md b/implementations/graph-client/README.md
index 531a36cc..dfd5357a 100644
--- a/implementations/graph-client/README.md
+++ b/implementations/graph-client/README.md
@@ -12,8 +12,8 @@
 
                  
 
                1. 22EB MUST accept application/graphql-response+json and match the content-type
                  2. 
 
                2. 4655 MUST accept application/json and match the content-type
                  3. 
-
                3. 47DE SHOULD accept */* and use application/json for the content-type
                  4. 
-
                4. 80D8 SHOULD assume application/json content-type when accept is missing
                  5. 
+
                5. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                  6. 
+
                6. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                  7. 
 
                7. 82A3 MUST use utf-8 encoding when responding
                  8. 
 
                8. BF61 MUST accept utf-8 encoded request
                  9. 
 
                9. 78D5 MUST assume utf-8 in request if encoding is unspecified
                  10. 
diff --git a/implementations/graphql-helix/README.md b/implementations/graphql-helix/README.md
index c3366b42..716b5420 100644
--- a/implementations/graphql-helix/README.md
+++ b/implementations/graphql-helix/README.md
@@ -13,8 +13,8 @@
 
                  Passing
                  
 
                    
 
                  1. 4655 MUST accept application/json and match the content-type
                    2. 
-
                  2. 47DE SHOULD accept */* and use application/json for the content-type
                    3. 
-
                  3. 80D8 SHOULD assume application/json content-type when accept is missing
                    4. 
+
                  4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                    5. 
+
                  5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                    6. 
 
                  6. 82A3 MUST use utf-8 encoding when responding
                    7. 
 
                  7. BF61 MUST accept utf-8 encoded request
                    8. 
 
                  8. 78D5 MUST assume utf-8 in request if encoding is unspecified
                    9. 
diff --git a/implementations/graphql-yoga/README.md b/implementations/graphql-yoga/README.md
index 21cf804b..3053b1fd 100644
--- a/implementations/graphql-yoga/README.md
+++ b/implementations/graphql-yoga/README.md
@@ -11,8 +11,8 @@
 
                      
 
                    1. 22EB MUST accept application/graphql-response+json and match the content-type
                      2. 
 
                    2. 4655 MUST accept application/json and match the content-type
                      3. 
-
                    3. 47DE SHOULD accept */* and use application/json for the content-type
                      4. 
-
                    4. 80D8 SHOULD assume application/json content-type when accept is missing
                      5. 
+
                    5. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                      6. 
+
                    6. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                      7. 
 
                    7. 82A3 MUST use utf-8 encoding when responding
                      8. 
 
                    8. BF61 MUST accept utf-8 encoded request
                      9. 
 
                    9. 78D5 MUST assume utf-8 in request if encoding is unspecified
                      10. 
diff --git a/implementations/hotchocolate/README.md b/implementations/hotchocolate/README.md
index 6a1205c1..cafaf0bd 100644
--- a/implementations/hotchocolate/README.md
+++ b/implementations/hotchocolate/README.md
@@ -4,14 +4,16 @@
 
 
                        
 
                      • 68 audits in total
                        • 
-
                      • ✅ 62 pass
                        • 
-
                      • ❗️ 6 warnings (optional)
                        • 
+
                      • ✅ 64 pass
                        • 
+
                      • ❗️ 4 warnings (optional)
                        • 
 
                      
 
 
                      Passing
                      
 
                        
 
                      1. 22EB MUST accept application/graphql-response+json and match the content-type
                        2. 
 
                      2. 4655 MUST accept application/json and match the content-type
                        3. 
+
                      3. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                        4. 
+
                      4. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                        5. 
 
                      5. 82A3 MUST use utf-8 encoding when responding
                        6. 
 
                      6. BF61 MUST accept utf-8 encoded request
                        7. 
 
                      7. 78D5 MUST assume utf-8 in request if encoding is unspecified
                        8. 
@@ -77,48 +79,6 @@
 
                        Warnings
                        
 The server SHOULD support these, but is not required.
 
                          
-
                        1. 47DE SHOULD accept */* and use application/json for the content-type
-
                          
-Response header content-type does not contain application/json
-
                          {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "transfer-encoding": "chunked",
-    "server": "Kestrel",
-    "date": "",
-    "content-type": "application/graphql-response+json; charset=utf-8"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
                          
-
                          
-
                          2. 
-
                        2. 80D8 SHOULD assume application/json content-type when accept is missing
-
                          
-Response header content-type does not contain application/json
-
                          {
-  "statusText": "OK",
-  "status": 200,
-  "headers": {
-    "transfer-encoding": "chunked",
-    "server": "Kestrel",
-    "date": "",
-    "content-type": "application/graphql-response+json; charset=utf-8"
-  },
-  "body": {
-    "data": {
-      "__typename": "Query"
-    }
-  }
-}
-
                          
-
                          
-
                          3. 
 
                        3. 58B0 SHOULD use 4xx or 5xx status codes on string {extensions} parameter when accepting application/json
 
                          
 Response status is not between 400 and 599
diff --git a/implementations/hotchocolate/report.json b/implementations/hotchocolate/report.json
index 05a4235b..fd5d4049 100644
--- a/implementations/hotchocolate/report.json
+++ b/implementations/hotchocolate/report.json
@@ -1,7 +1,7 @@
 {
   "total": 68,
-  "ok": 62,
+  "ok": 64,
   "notice": 0,
-  "warn": 6,
+  "warn": 4,
   "error": 0
 }
diff --git a/implementations/lighthouse/README.md b/implementations/lighthouse/README.md
index 0e8f3536..07b1f953 100644
--- a/implementations/lighthouse/README.md
+++ b/implementations/lighthouse/README.md
@@ -13,8 +13,8 @@
 
                          Passing
                          
 
                            
 
                          1. 4655 MUST accept application/json and match the content-type
                            2. 
-
                          2. 47DE SHOULD accept */* and use application/json for the content-type
                            3. 
-
                          3. 80D8 SHOULD assume application/json content-type when accept is missing
                            4. 
+
                          4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                            5. 
+
                          5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                            6. 
 
                          6. 82A3 MUST use utf-8 encoding when responding
                            7. 
 
                          7. BF61 MUST accept utf-8 encoded request
                            8. 
 
                          8. 78D5 MUST assume utf-8 in request if encoding is unspecified
                            9. 
diff --git a/implementations/mercurius/README.md b/implementations/mercurius/README.md
index f348a0df..1064fe2d 100644
--- a/implementations/mercurius/README.md
+++ b/implementations/mercurius/README.md
@@ -13,8 +13,8 @@
 
                            Passing
                            
 
                              
 
                            1. 4655 MUST accept application/json and match the content-type
                              2. 
-
                            2. 47DE SHOULD accept */* and use application/json for the content-type
                              3. 
-
                            3. 80D8 SHOULD assume application/json content-type when accept is missing
                              4. 
+
                            4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                              5. 
+
                            5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                              6. 
 
                            6. 82A3 MUST use utf-8 encoding when responding
                              7. 
 
                            7. BF61 MUST accept utf-8 encoded request
                              8. 
 
                            8. 78D5 MUST assume utf-8 in request if encoding is unspecified
                              9. 
diff --git a/implementations/postgraphile/README.md b/implementations/postgraphile/README.md
index 6dce9207..ec521761 100644
--- a/implementations/postgraphile/README.md
+++ b/implementations/postgraphile/README.md
@@ -13,8 +13,8 @@
 
                              Passing
                              
 
                                
 
                              1. 4655 MUST accept application/json and match the content-type
                                2. 
-
                              2. 47DE SHOULD accept */* and use application/json for the content-type
                                3. 
-
                              3. 80D8 SHOULD assume application/json content-type when accept is missing
                                4. 
+
                              4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                                5. 
+
                              5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                                6. 
 
                              6. 82A3 MUST use utf-8 encoding when responding
                                7. 
 
                              7. BF61 MUST accept utf-8 encoded request
                                8. 
 
                              8. 78D5 MUST assume utf-8 in request if encoding is unspecified
                                9. 
diff --git a/implementations/thegraph/README.md b/implementations/thegraph/README.md
index 9cf16268..eb2a547f 100644
--- a/implementations/thegraph/README.md
+++ b/implementations/thegraph/README.md
@@ -13,8 +13,8 @@
 
                                Passing
                                
 
                                  
 
                                1. 4655 MUST accept application/json and match the content-type
                                  2. 
-
                                2. 47DE SHOULD accept */* and use application/json for the content-type
                                  3. 
-
                                3. 80D8 SHOULD assume application/json content-type when accept is missing
                                  4. 
+
                                4. 47DE SHOULD accept */* and use application/graphql-response+json or application/json for the content-type
                                  5. 
+
                                5. 80D8 SHOULD assume application/json or application/graphql-response+json content-type when accept is missing
                                  6. 
 
                                6. 82A3 MUST use utf-8 encoding when responding
                                  7. 
 
                                7. BF61 MUST accept utf-8 encoded request
                                  8. 
 
                                8. 78D5 MUST assume utf-8 in request if encoding is unspecified
                                  9.