graphql-java-kickstart/graphql-java-servlet

Sending malformed POST request results in HTTP 500 instead of HTTP 400

artem-ag opened this issue · 1 comments

artem-ag commented

Describe the bug
GraphQL server respond with HTTP 500 instead of HTTP 400 when malformed request body is received.

To Reproduce

  1. Setup a server with any GraphQL schema.
  2. Send POST request to the server with request body set to "Bad request" or any other invalid Json.
  3. See HTTP 500 error instead of HTTP 400.

Expected behavior
Server should respond with HTTP 400 to malformed requests.

Screenshots
N/A

Desktop (please complete the following information):

  • OS: Mac OSX
  • Request sent from Postman
  • graphql-java 15
  • graphql-java-servlet 9.1.0

Additional context
HTTP 400 is considered user error indicating that server will not process the request. HTTP 500 is consider backend server error. From production service maintenance point of view any HTTP 500 should be fixed by developers supporting the product. While nothing can be done about clients sending bad requests and those errors can be safely ignored to a degree.

mihbor commented

Seeing this too. Versions:
com.graphql-java-kickstart:graphql-java-kickstart:9.1.0
com.graphql-java:graphql-java:14.0

This is a regression as it worked correctly in 8.0.0

The problem is in graphql.kickstart.servlet.HttpRequestHandlerImpl.handle() where it's doing this:

    } catch (GraphQLException e) {
      response.setStatus(STATUS_BAD_REQUEST);
      log.info("Bad request: cannot create invocation input parser", e);
      throw e;
    } catch (Throwable t) {
      response.setStatus(500);
      log.info("Bad request: cannot create invocation input parser", t);
      throw t;
    }

Malformed requests result in JsonParseException which are caught by the second catch clause.
I think JsonParseExceptions should be treated as bad requests like GraphQLException or be caught sooner and re-thrown as GraphQLExceptions, so that the status is set to 400.

  • 👍1