nautilus / gateway

A federated api gateway for graphql services. https://gateway.nautilus.dev/
MIT License
397 stars 49 forks source link

Fix panics on non-GET/non-POST requests #186

Closed JohnStarich closed 1 year ago

JohnStarich commented 1 year ago

Stack trace from the original panic:

       panic: runtime error: index out of range [0] with length 0

goroutine 20 [running]:
testing.tRunner.func1.2({0x102910300, 0x140001682e8})
        src/testing/testing.go:1396 +0x1c8
testing.tRunner.func1()
        src/testing/testing.go:1399 +0x378
panic({0x102910300, 0x140001682e8})
        src/runtime/panic.go:884 +0x204
github.com/nautilus/gateway.(*Gateway).GraphQLHandler(0x1400015a100, {0x10293e208, 0x14000163540}, 0x1400015a300)
        gateway/http.go:150 +0x8c4
github.com/nautilus/gateway.TestGraphQLHandler_OptionsMethod(0x140001029c0)
        gateway/http_test.go:1470 +0x250
testing.tRunner(0x140001029c0, 0x102937a80)
        src/testing/testing.go:1446 +0x10c
created by testing.(*T).Run
        src/testing/testing.go:1493 +0x300
FAIL    github.com/nautilus/gateway     0.778s
FAIL

It failed to form a response because none had been created. This PR prevents further execution when the HTTP method is not supported.

The GraphQL over HTTP working draft provides a little bit of clarity here, though stops short of defining non-GET and non-POST response status codes.

Given most servers return 405 Method Not Allowed in these kinds of scenarios and it is certainly better than panicking (typically with a 500 error), I think this is the right move for now.