apollographql / router

A configurable, high-performance routing runtime for Apollo Federation 🚀
https://www.apollographql.com/docs/router/
Other
805 stars 269 forks source link

Sending graphql request with empty string as operationName produce invalid response #4837

Open IvanGoncharov opened 6 months ago

IvanGoncharov commented 6 months ago

Describe the bug Issue was reported by @bonnici in Slack: https://apollograph.slack.com/archives/C02UX05LF4K/p1710991184963719 Here is example of requests producing invalid responses:

{ 
  "operationName": "", 
   "query": "query ExampleQuery { me { id } }"
}

Router responses with:

{"data":null}

To Reproduce Steps to reproduce the behavior:

  1. Run following using starstuff:
    curl -H 'Content-Type: application/json' http://127.0.0.1:4000/ -d '{ "operationName": "", "query": "query { me { id } }" }'
  2. See {"data":null} as result

Expected behavior It should be a response containing the error and without data.

image

https://spec.graphql.org/October2021/#GetOperation()

bonnici commented 2 months ago

I think this is causing some errors related to usage reporting. Now when I try to submit the same payload, I see the router error:

client error reported at ingress: If you see this frequently in your logs, please reach out to support@apollographql.com.
Details: Unparseable statsRecordKey with invalid metadata for graph BR-074-Tester@playground:

We're seeing this error come up very frequently for some customers, especially within the last week.

smyrick commented 2 months ago

According to the spec, then should this JSON body run the operation with no errors? As the name is empty and the string is empty

curl -H 'Content-Type: application/json' http://127.0.0.1:4000/ -d '{ "operationName": "", "query": "query { me { id } }" }'

vs this is mismatch

curl -H 'Content-Type: application/json' http://127.0.0.1:4000/ -d '{ "operationName": "", "query": "query Hello { me { id } }" }'
timbotnik commented 2 months ago

Similarly wondering if this happens for any mismatch of operation name not found in the document.

SimonSapin commented 2 months ago

According to the spec, then should this JSON body run the operation with no errors? As the name is empty and the string is empty

I think not, because the empty string is different from null / absent