From 0f4a6904533ccdd9f390708558e9a3ee0105abb1 Mon Sep 17 00:00:00 2001 From: Martin Bonnin Date: Fri, 17 Apr 2026 17:22:03 +0200 Subject: [PATCH 1/3] Do not allow operationName=null in GET --- spec/GraphQLOverHTTP.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/spec/GraphQLOverHTTP.md b/spec/GraphQLOverHTTP.md index d621d2c7..6c67387f 100644 --- a/spec/GraphQLOverHTTP.md +++ b/spec/GraphQLOverHTTP.md @@ -237,9 +237,6 @@ Note: An HTTP request that encodes parameters of the same names but of the wrong type, or that omits required parameters, is not a well-formed _GraphQL-over-HTTP request_. -Note: Specifying `null` for optional request parameters is equivalent to not -specifying them at all. - Note: So long as it is a string, {query} does not have to parse or validate to be part of a well-formed _GraphQL-over-HTTP request_. @@ -285,19 +282,19 @@ the document as specified in The {operationName} parameter, if present, must be a string. -Each of the {variables} and {extensions} parameters, if used, MUST be encoded as -a JSON string. +Each of the {variables} and {extensions} parameters, if present and not the +empty string, MUST be encoded as a JSON string. -The {operationName} parameter, if supplied and not the empty string, represents +The {operationName} parameter, if present and not the empty string, represents the name of the operation to be executed within the {query} as a string. +Specifying the empty string for optional request parameters is equivalent to not +specifying them at all. + Note: In the final URL all of these parameters will appear in the query component of the request URL as URL-encoded values due to the WHATWG URLSearchParams encoding specified above. -Setting the value of the {operationName} parameter to the empty string is -equivalent to omitting the {operationName} parameter. - Note: By the above, `operationName=null` represents an operation with the name `"null"` (such as `query null { __typename }`). If a literal `null` is desired, either omit {operationName} or set it to the empty string. @@ -384,6 +381,9 @@ object. Servers receiving a request with additional properties MUST ignore properties they do not understand. +Specifying null for optional request parameters is equivalent to not specifying +them at all. + ### Example If we wanted to execute the following GraphQL query: From 11b000ca51caeb597047d5a092d778e1ebb131ce Mon Sep 17 00:00:00 2001 From: Benjie Date: Thu, 23 Apr 2026 13:21:31 +0100 Subject: [PATCH 2/3] Escape `null` --- spec/GraphQLOverHTTP.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/GraphQLOverHTTP.md b/spec/GraphQLOverHTTP.md index 6c67387f..e7d1582a 100644 --- a/spec/GraphQLOverHTTP.md +++ b/spec/GraphQLOverHTTP.md @@ -381,7 +381,7 @@ object. Servers receiving a request with additional properties MUST ignore properties they do not understand. -Specifying null for optional request parameters is equivalent to not specifying +Specifying `null` for optional request parameters is equivalent to not specifying them at all. ### Example From d4e2d199355fd10bcb51dce2e7bb273942e4e955 Mon Sep 17 00:00:00 2001 From: Martin Bonnin Date: Thu, 23 Apr 2026 14:35:35 +0200 Subject: [PATCH 3/3] format --- spec/GraphQLOverHTTP.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/GraphQLOverHTTP.md b/spec/GraphQLOverHTTP.md index e7d1582a..2230016e 100644 --- a/spec/GraphQLOverHTTP.md +++ b/spec/GraphQLOverHTTP.md @@ -381,8 +381,8 @@ object. Servers receiving a request with additional properties MUST ignore properties they do not understand. -Specifying `null` for optional request parameters is equivalent to not specifying -them at all. +Specifying `null` for optional request parameters is equivalent to not +specifying them at all. ### Example