graphql-multipart-request-spec VS subscriptions-transport-ws

The GraphQL specification itself doesn't natively support file uploads, so the solution typically involves using extensions or additional libraries. The easiest and most straightforward way is by converting the file to Base64 before sending it to the server, you can include it as a string in the GraphQL request. This offcourse has a downside, it can increase the payload size, so it may not be the most efficient solution for large files. Other options that involve using extensions or additional libraries are using GraphQL multipart request specification and Apollo Server with Apollo Upload Client

Also, we manage to upload files via GraphQL just fine. Turns out nothing prevents you from putting a GraphQL query in a multipart form. Frameworks support this just fine, and if not, just write your own middleware, it's not even that hard.

There is a specification (and implementation) for sending files through GraphQL. https://github.com/jaydenseric/graphql-multipart-request-spec

We figured out that it was possible to reference a file several times by implementing the reference spec (https://github.com/jaydenseric/graphql-multipart-request-spec) for both a client and a server. We have no record of this vulnerability used in the wild, but we know for sure that a lot of popular projects on GitHub are vulnerable.

The GraphQL multipart specification describes how to implement file uploads in GraphQL. While usual GraphQL queries are sent as application/json, file uploads are sent as multipart/form-data. This means that the HTTP request body has multiple parts, and their functions, described in the specification, can be summarized as follows:

Hey, graphql-upload works on top of the graphql-multipart-request-spec, of which you can find the specification here.

In this article you will learn the widely accepted method of implementing file upload which is becoming increasingly popular in new apps. The technique follows the specification by @jaydenseric.

GraphQL-Multipart-Request: enables great file upload support.

Multipart File Uploads ✔️

One important thing which GraphQL Spec did not discuss about is a way to transmit files over the wire when using GraphQL. This is where GraphQL Upload comes in. While not an official spec from GraphQL foundation, Jayden had done a great job to put together a multi part spec to address exactly this problem.

Additionally, we created a bit more work for ourselves by upgrading the library we use for GraphQL subscriptions over web sockets, moving from the seemingly unmaintained subscriptions-transport-ws to the active graphql-ws project (which is URLQ’s library of choice for subscriptions).

Okay but seriously, if you've fallen down the rabbit hole of Apollo docs pointing you towards one library (subscription-transport-ws) which then points you to another (graphql-ws) , and so on and so forth, then hopefully this helps pull you out.

I'm looking for graphql server that can do queries and mutations over websocket, like subscriptions-transport-ws. Juniper and async-graphql both looks promising and async-graphql at least uses wording Subscriptions (WebSocket transport) in features but i couldn't find much more or any examples about that from the docs or repo.

graphql-yoga is built on other packages that provide functionality required for building a GraphQL server such as web server frameworks like express and apollo-server, GraphQL subscriptions with graphql-subscriptions and subscriptions-transport-ws, GraphQL engine & schema helpers including graphql.js and graphql-tools, and an interactive GraphQL IDE with graphql-playground.

The javascript implementation is at subscriptions-transport-ws

Okay, so, how do I use WebSockets to add support for the GraphQL subscription operation? Doing a basic Google search, you’d be faced with a single solution, namely subscriptions-transport-ws. Looking through the repository, checking recent comments, reading through the issues and open PRs - might have you notice the abundance of bugs and their security implications. A summary can be found here.

While subscription-transport-ws from Apollo initially started off this journey, it is not actively maintained and GraphQL WS by Denis definitely is a great replacement to that having no external dependencies and having the ability to work across many frameworks.

apollo-server plans to remove WebSocket support, which is currenlty done over the deprecated graphql-ws protocol (as implemented by the unmaintained subscription-transport-ws module by apollo), in the next major version.

https://github.com/apollographql/subscriptions-transport-ws, which is used by Apollo Server does support executing queries and mutations actually but you are better off moving away it anyway (check the text in their README!)