Invalid GraphQL requests must result in HTTP 400 responses

[bclozel]

As explained in the GraphQL over HTTP spec:

If the GraphQL response does not contain the {data} entry then the server MUST reply with a 4xx or 5xx status code as appropriate.

Note: The GraphQL specification indicates that the only situation in which the GraphQL response does not include the {data} entry is one in which the {errors} entry is populated.

If the GraphQL request is invalid (e.g. it is malformed, or does not pass validation) then the server SHOULD reply with 400 status code.

Currently Spring for GraphQL responds with an HTTP 200 OK response in this case:

{
  "errors": [
    {
      "message": "Validation error (FieldUndefined@[spring]) : Field 'spring' in type 'Query' is undefined",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "extensions": {
        "classification": "ValidationError"
      }
    }
  ]
}

[erwinc1]

If you example response is the complete response you got, then "data" block is missing so this must (as opposed to your title) resolve in a 4xx or 5xx according to your citation, am I right?

[bclozel]

@erwinc1 Yes. I've updated the title.
We discussed this issue this morning and we are pausing it to get some clarification about this. Other issue comments seem to contradict this statement in the spec.

[bclozel]

I'm closing this issue as this PR clarifies the fact that only requests that cannot be parsed should result in 4xx/5xx response status codes.

[benjie]

Just to add "from the horse's mouth" to this:

If the GraphQL response does not contain the {data} entry then the server MUST reply with a 4xx or 5xx status code as appropriate.

This is still true for responses that are served using the application/graphql-response+json media type.

Note: all servers are expected to support the application/graphql-response+json media type by 1st Jan 2025, and clients should start adding it to their Accept headers now so that they can get the goodness of HTTP status codes if the server supports them, without the ambiguities inherent in using HTTP status codes with legacy GraphQL-over-HTTP.

only requests that cannot be parsed should result in 4xx/5xx response status codes.

This is true for responses using the application/json legacy media type only.