graphql-over-http VS graphql-multipart-request-spec

Another major pain is the fact that operation names and HTTP codes are often hidden in request bodies which makes it really hard to see what is going on in standard monitoring tools. It's possible to write some converter but it's beyond me why some people decided that requests which failed on the server respond with status 200. GraphQL spec doesn't define how it should behave, there's only a proposal (https://github.com/graphql/graphql-over-http)

The GraphQL over HTTP specification states the following:

However, if you are doing GraphQL subscriptions over Server Sent Events (HTTP) (which is currently not part of the GraphQL over HTTP specification), the data flow is only from server to client. So each operation must be a separate request, which should be no problem when using HTTP/2, as the browser connection limit is not hit so fast (There are also workarounds to this if you cannot ise HTTP/2).

Complementary to the note, you can learn more about GraphQL over HTTP in the specification over here: https://github.com/graphql/graphql-over-http/blob/main/spec/GraphQLOverHTTP.md

GraphQL-spec, GraphQL-over-HTTP: guarantees your GraphQL API to work with all existing GraphQL clients (Apollo, Relay, URQL, and more).

Note: While GraphQL can be done over almost any protocol, this article focuses on the most commonly used protocol GraphQL over HTTP. However, most knowledge can be transferred to other protocols such as GraphQL over WebSockets or other more exotic ones.

There is also the GraphQL over HTTP Specification repository https://github.com/graphql/graphql-over-http

graphql-sse is a reference implementation of the GraphQL over Server-Sent Events Protocol aiming to become a part of the GraphQL over HTTP standard.

With no further ado - I humbly introduce graphql-ws. A coherent, feature-full, zero-dependency, plug-n-play, lazy, simple, server and client implementation of the new, security first GraphQL over WebSocket Protocol with full support for all 3 GraphQL operations: Queries, Mutations and Subscriptions. The protocol aims to be standardised and become a part of GraphQL with the help of the foundation’s GraphQL over HTTP work group.

You could additionally also choose a specific HTTP code for that scenario (although that would contradict the official GraphQL over HTTP spec https://github.com/graphql/graphql-over-http/blob/main/spec/GraphQLOverHTTP.md).

The GraphQL specification itself doesn't natively support file uploads, so the solution typically involves using extensions or additional libraries. The easiest and most straightforward way is by converting the file to Base64 before sending it to the server, you can include it as a string in the GraphQL request. This offcourse has a downside, it can increase the payload size, so it may not be the most efficient solution for large files. Other options that involve using extensions or additional libraries are using GraphQL multipart request specification and Apollo Server with Apollo Upload Client

Also, we manage to upload files via GraphQL just fine. Turns out nothing prevents you from putting a GraphQL query in a multipart form. Frameworks support this just fine, and if not, just write your own middleware, it's not even that hard.

There is a specification (and implementation) for sending files through GraphQL. https://github.com/jaydenseric/graphql-multipart-request-spec

We figured out that it was possible to reference a file several times by implementing the reference spec (https://github.com/jaydenseric/graphql-multipart-request-spec) for both a client and a server. We have no record of this vulnerability used in the wild, but we know for sure that a lot of popular projects on GitHub are vulnerable.

The GraphQL multipart specification describes how to implement file uploads in GraphQL. While usual GraphQL queries are sent as application/json, file uploads are sent as multipart/form-data. This means that the HTTP request body has multiple parts, and their functions, described in the specification, can be summarized as follows:

Hey, graphql-upload works on top of the graphql-multipart-request-spec, of which you can find the specification here.

In this article you will learn the widely accepted method of implementing file upload which is becoming increasingly popular in new apps. The technique follows the specification by @jaydenseric.

GraphQL-Multipart-Request: enables great file upload support.

Multipart File Uploads ✔️

One important thing which GraphQL Spec did not discuss about is a way to transmit files over the wire when using GraphQL. This is where GraphQL Upload comes in. While not an official spec from GraphQL foundation, Jayden had done a great job to put together a multi part spec to address exactly this problem.