graphql-ws VS graphql-multipart-request-spec

When using a GraphQL over Websocket protocol you can execute all operation kinds (query, mutation and subscription) over that transport as it is a bidirectional protocol.

The GraphQL over WebSocket solution definitely requires an additional library on the client for the complexity of the protocol (namely graphql-ws). The readme of that project describes how you can connect to a GraphQL over WebSocket compliant server.

10:29:46 AM: Build ready to start 10:29:47 AM: build-image version: d2c6dbeac570350a387d832f64bc980dc964ad65 (focal) 10:29:47 AM: build-image tag: v4.8.0 10:29:47 AM: buildbot version: d7330f24833f29d0263d28116347ab83094a2561 10:29:47 AM: Fetching cached dependencies 10:29:48 AM: Failed to fetch cache, continuing with build 10:29:48 AM: Starting to prepare the repo for build 10:29:48 AM: No cached dependencies found. Cloning fresh repo 10:29:48 AM: git clone https://github.com/josephmasongsong/josephmasongsong-v2 10:29:49 AM: Preparing Git Reference refs/heads/main 10:29:49 AM: Parsing package.json dependencies 10:29:50 AM: Starting build script 10:29:50 AM: Installing dependencies 10:29:50 AM: Python version set to 2.7 10:29:51 AM: Downloading and installing node v16.15.0... 10:29:51 AM: Downloading https://nodejs.org/dist/v16.15.0/node-v16.15.0-linux-x64.tar.xz... 10:29:51 AM: Computing checksum with sha256sum 10:29:52 AM: Checksums matched! 10:29:54 AM: Now using node v16.15.0 (npm v8.5.5) 10:29:54 AM: Started restoring cached build plugins 10:29:54 AM: Finished restoring cached build plugins 10:29:54 AM: Attempting ruby version 2.7.2, read from environment 10:29:56 AM: Using ruby version 2.7.2 10:29:56 AM: Using PHP version 8.0 10:29:56 AM: No npm workspaces detected 10:29:56 AM: Started restoring cached node modules 10:29:56 AM: Finished restoring cached node modules 10:29:57 AM: Installing NPM modules using NPM version 8.5.5 10:29:59 AM: npm WARN EBADENGINE Unsupported engine { 10:29:59 AM: npm WARN EBADENGINE package: '[email protected]', 10:29:59 AM: npm WARN EBADENGINE required: { npm: 'please-use-yarn', yarn: '>= 1.19.1' }, 10:29:59 AM: npm WARN EBADENGINE current: { node: 'v16.15.0', npm: '8.5.5' } 10:29:59 AM: npm WARN EBADENGINE } 10:30:16 AM: npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-url#deprecated 10:30:16 AM: npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-resolve#deprecated 10:30:17 AM: npm WARN deprecated [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. 10:30:17 AM: npm WARN deprecated [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. 10:30:17 AM: npm WARN deprecated [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. 10:30:20 AM: npm WARN deprecated [email protected]: Package moved to @redux-devtools/extension. 10:30:21 AM: npm WARN deprecated [email protected]: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. 10:30:25 AM: npm WARN deprecated [email protected]: The `subscriptions-transport-ws` package is no longer maintained. We recommend you use `graphql-ws` instead. For help migrating Apollo software to `graphql-ws`, see https://www.apollographql.com/docs/apollo-server/data/subscriptions/#switching-from-subscriptions-transport-ws For general help using `graphql-ws`, see https://github.com/enisdenjo/graphql-ws/blob/master/README.md 10:30:30 AM: npm WARN deprecated [email protected]: No longer maintained. Use [lru-cache](http://npm.im/lru-cache) version 7.6 or higher, and provide an asynchronous `fetchMethod` option. 10:30:31 AM: npm WARN deprecated @types/[email protected]: This is a stub types definition. vfile-message provides its own type definitions, so you do not need this installed. 10:30:36 AM: npm WARN deprecated [email protected]: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. 10:30:40 AM: npm WARN deprecated [email protected]: Please see https://github.com/lydell/urix#deprecated 10:30:41 AM: npm WARN deprecated [email protected]: https://github.com/lydell/resolve-url#deprecated 10:30:44 AM: npm WARN deprecated [email protected]: This SVGO version is no longer supported. Upgrade to v2.x.x. 10:31:11 AM: npm ERR! code E401 10:31:11 AM: npm ERR! Incorrect or missing password. 10:31:11 AM: npm ERR! If you were trying to login, change your password, create an 10:31:11 AM: npm ERR! authentication token or enable two-factor authentication then 10:31:11 AM: npm ERR! that means you likely typed your password in incorrectly. 10:31:11 AM: Creating deploy upload records 10:31:11 AM: npm ERR! Please try again, or recover your password at: 10:31:11 AM: npm ERR! https://www.npmjs.com/forgot 10:31:11 AM: npm ERR! 10:31:11 AM: npm ERR! If you were doing some other operation then your saved credentials are 10:31:11 AM: npm ERR! probably out of date. To correct this please try logging in again with: 10:31:11 AM: Failed during stage 'building site': Build script returned non-zero exit code: 1 (https://ntl.fyi/exit-code-1) 10:31:11 AM: npm ERR! npm login 10:31:11 AM: npm ERR! A complete log of this run can be found in: 10:31:11 AM: npm ERR! /opt/buildhome/.npm/_logs/2022-06-09T17_29_57_939Z-debug-0.log 10:31:11 AM: Error during NPM install 10:31:11 AM: Build was terminated: Build script returned non-zero exit code: 1 10:31:11 AM: Failing build: Failed to build site 10:31:11 AM: Finished processing build request in 1m24.040513333s

There is already a JavaScript implementation for server + client with support for multiplexing from the same maintainer of graphql-ws: graphql-sse

Actually WebSocket is not the only protocol for executing GraphQL subscriptions. There is also a graphql-over-sse protocol, which is much more lightweight, and uses Server Sent Events. A popular implementation of it is the graphql-sse library, which is maintained by the same person as graphql-ws. The setup and API of both libraries is pretty similar.

That said, I feel so close to success that I can't quite give up. I am using graphql-ws as I understand this to be the new standard implementation of GraphQL Subscriptions. However, of course, Apollo subscriptions have not been updated to implement this. So, looking at the Recipes over on the graphql-ws documentation I have found the guide for using Apollo client. However as I am new to Apollo, it is using a lot of terms I am unfamiliar with.

Okay but seriously, if you've fallen down the rabbit hole of Apollo docs pointing you towards one library (subscription-transport-ws) which then points you to another (graphql-ws) , and so on and so forth, then hopefully this helps pull you out.

The most common protocol used today for subscriptions is the Apollo websocket protocol.

GraphQL subscriptions are just web sockets. You can check graphql-ws package if you want something without Apollo dependency. Though I don't understand why you want to not depend on it in the first place.

The GraphQL specification itself doesn't natively support file uploads, so the solution typically involves using extensions or additional libraries. The easiest and most straightforward way is by converting the file to Base64 before sending it to the server, you can include it as a string in the GraphQL request. This offcourse has a downside, it can increase the payload size, so it may not be the most efficient solution for large files. Other options that involve using extensions or additional libraries are using GraphQL multipart request specification and Apollo Server with Apollo Upload Client

Also, we manage to upload files via GraphQL just fine. Turns out nothing prevents you from putting a GraphQL query in a multipart form. Frameworks support this just fine, and if not, just write your own middleware, it's not even that hard.

There is a specification (and implementation) for sending files through GraphQL. https://github.com/jaydenseric/graphql-multipart-request-spec

We figured out that it was possible to reference a file several times by implementing the reference spec (https://github.com/jaydenseric/graphql-multipart-request-spec) for both a client and a server. We have no record of this vulnerability used in the wild, but we know for sure that a lot of popular projects on GitHub are vulnerable.

The GraphQL multipart specification describes how to implement file uploads in GraphQL. While usual GraphQL queries are sent as application/json, file uploads are sent as multipart/form-data. This means that the HTTP request body has multiple parts, and their functions, described in the specification, can be summarized as follows:

Hey, graphql-upload works on top of the graphql-multipart-request-spec, of which you can find the specification here.

In this article you will learn the widely accepted method of implementing file upload which is becoming increasingly popular in new apps. The technique follows the specification by @jaydenseric.

GraphQL-Multipart-Request: enables great file upload support.

Multipart File Uploads ✔️

One important thing which GraphQL Spec did not discuss about is a way to transmit files over the wire when using GraphQL. This is where GraphQL Upload comes in. While not an official spec from GraphQL foundation, Jayden had done a great job to put together a multi part spec to address exactly this problem.