Skip to content

Add opt-in support for the HTTP QUERY method - #10420

Merged
glen-84 merged 13 commits into
mainfrom
gai/http-query-method
Sep 23, 2026
Merged

glen-84 merged 13 commits into
mainfrom
gai/http-query-method

Conversation

@glen-84

@glen-84 glen-84 commented Sep 23, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Adds opt-in support for the HTTP QUERY method (RFC 10008) on the GraphQL endpoint, following the QUERY section of graphql/graphql-over-http#411 at its current head 292268c4; that PR is not merged yet. GraphQLServerOptions.EnableQueryRequests (default false) enables HttpQueryMiddleware, which executes a single query operation from a POST-shaped JSON body. A mutation or subscription is refused with 422 (200 for application/json under Draft20250508 and Legacy, per those revisions' rule), request, operation, and variable batches are refused with 400, and @defer and @stream work as they do over GET. Under Draft20260903 the endpoint lists QUERY in Allow, answers a QUERY request with an unsupported Content-Type with 415, and carries Accept-Query: application/json on its 405, 204, and 415 responses. The persisted-operation endpoint maps QUERY when the option is on.
  • HotChocolate.Transport.Http gains GraphQLHttpMethod.Query and nine QueryAsync overloads mirroring GetAsync. The diagnostics span of a QUERY request is GraphQL HTTP QUERY. Three docs pages describe the option, the request shape, and the status codes.
  • The Fusion gateway now enforces the request flags the HTTP layer derives from the method and the Accept header, as the Core executor already does. On a gateway, a mutation over GET answers 405 instead of executing, a mutation or subscription over QUERY answers 422, and a subscription or an operation with @defer or @stream whose Accept header grants no streaming media type answers 406 before execution. The Fusion 16.7 migration guide documents this change.

Follow-ups

  • QUERY requests from the gateway to source schemas.
  • 405 with Allow for unmapped methods on the persisted-operation path, which answer 404 under every transport version today.
  • Content-Type validation on the persisted-operation path, which parses any request media type for POST and QUERY today.
  • Bound handler parameters for the six persisted-operation routes, which carry an ASP0018 suggestion.
  • A root-level @defer with no undeferred sibling answers 500 on a gateway.
  • 413 for oversize QUERY bodies, and a dated transport member if the status for a mutation over GET moves upstream.

Test plan

  • New tests: HttpQueryMiddlewareTests, the QUERY theories in GraphQLOverHttpSpecTests across Legacy, Draft20250508, and Draft20260903, QUERY routes in PersistedOperationMiddlewareTests, QueryAsync in GraphQLHttpClientTests, the Http_Query_SingleRequest_GetHeroName activity snapshots on net10 and net11, and OperationKindTests against a gateway.
  • Full runs of AspNetCore.Tests, Transport.Http.Tests, Diagnostics.Tests, Fusion.Execution.Tests, and Fusion.AspNetCore.Tests on net10 pass.
  • The pipeline, client, and Fusion execution projects build on net8 through net11 with EnforceCodeStyleInBuild. HttpMethods.Query and HttpMethods.IsQuery come from a static extension block on net8 and net9, where ASP.NET Core does not define them.

Copilot AI lite review requested due to automatic review settings September 23, 2026 09:14
@github-actions github-actions Bot added 📚 documentation This issue is about working on our documentation. 🌶️ hot chocolate labels Sep 23, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 High severity

Open (1)
What changed in this PR

Adds opt-in HTTP QUERY support across ASP.NET Core, Azure Functions, clients, diagnostics, Fusion, tests, and documentation.

Changes:

  • Adds EnableQueryRequests and QUERY middleware with batching and status handling.
  • Adds client QueryAsync APIs and QUERY diagnostics.
  • Enforces operation-kind and incremental-delivery rules in Fusion.
File Description
website/​content/​docs/​hotchocolate/​server/​options.md Updated as part of this pull request.
website/​content/​docs/​hotchocolate/​server/​http-transport.md Updated as part of this pull request.
website/​content/​docs/​hotchocolate/​server/​endpoints.md Updated as part of this pull request.
website/​content/​docs/​fusion/​migration/​migrate-from-16-6-to-16-7.md Updated as part of this pull request.
src/​HotChocolate/​Fusion/​test/​Fusion.AspNetCore.Tests/​OperationKindTests.cs Updated as part of this pull request.
src/​HotChocolate/​Fusion/​src/​Fusion.Execution/​Properties/​FusionExecutionResources.resx Updated as part of this pull request.
src/​HotChocolate/​Fusion/​src/​Fusion.Execution/​Properties/​FusionExecutionResources.Designer.cs Updated as part of this pull request.
src/​HotChocolate/​Fusion/​src/​Fusion.Execution/​Execution/​Pipeline/​OperationExecutionMiddleware.cs Updated as part of this pull request.
src/​HotChocolate/​Fusion/​src/​Fusion.Execution/​Execution/​ErrorHelper.cs Updated as part of this pull request.
src/​HotChocolate/​Diagnostics/​test/​Diagnostics.Tests/​ActivityServerDiagnosticListenerTests.cs Updated as part of this pull request.
src/​HotChocolate/​Diagnostics/​test/​Diagnostics.Tests/​__snapshots__/​ActivityServerDiagnosticListenerTests.Http_Query_SingleRequest_GetHeroName.snap Updated as part of this pull request.
src/​HotChocolate/​Diagnostics/​test/​Diagnostics.Tests/​__snapshots__/​ActivityServerDiagnosticListenerTests.Http_Query_SingleRequest_GetHeroName_NET11_0.snap Updated as part of this pull request.
src/​HotChocolate/​Diagnostics/​src/​Diagnostics.Core/​Spans/​Http/​ExecuteHttpRequestSpan.cs Updated as part of this pull request.
src/​HotChocolate/​AzureFunctions/​src/​HotChocolate.AzureFunctions/​Extensions/​HotChocolateAzureFunctionServiceCollectionExtensions.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​test/​Transport.Http.Tests/​GraphQLHttpClientTests.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​test/​AspNetCore.Tests/​PersistedOperationMiddlewareTests.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​test/​AspNetCore.Tests/​HttpQueryMiddlewareTests.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​test/​AspNetCore.Tests/​GraphQLOverHttpSpecTests.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​test/​AspNetCore.Tests.Utilities/​TestOperationDocumentStorage.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​Transport.Http/​HttpResources.resx Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​Transport.Http/​HttpResources.Designer.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​Transport.Http/​GraphQLHttpMethod.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​Transport.Http/​GraphQLHttpClientExtensions.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​Transport.Http/​DefaultGraphQLHttpClient.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Utilities/​MiddlewareHelper.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Utilities/​ErrorHelper.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Properties/​AspNetCorePipelineResources.resx Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Properties/​AspNetCorePipelineResources.Designer.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​PersistedOperationMiddleware.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Options/​GraphQLServerOptions.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​MiddlewareFactory.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Instrumentation/​HttpRequestKind.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​HttpUnsupportedRequestMiddleware.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​HttpQueryMiddleware.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​HttpHeaderValues.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​HttpHeaderKeys.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Extensions/​HttpMethodsExtensions.cs Updated as part of this pull request.
src/​HotChocolate/​AspNetCore/​src/​AspNetCore.Pipeline/​Extensions/​EndpointRouteBuilderExtensions.cs Updated as part of this pull request.
Files not reviewed (3)
  • src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Properties/AspNetCorePipelineResources.Designer.cs: Generated file
  • src/HotChocolate/AspNetCore/src/Transport.Http/HttpResources.Designer.cs: Generated file
  • src/HotChocolate/Fusion/src/Fusion.Execution/Properties/FusionExecutionResources.Designer.cs: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@github-actions

github-actions Bot commented Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

Patch coverage

88.8% of changed lines covered (372/419)

File Covered Changed Patch %
…/AspNetCore/src/Transport.Http/GraphQLHttpClientExtensions.cs 58 79 73.4% 🔴
…/src/AspNetCore.Pipeline/PersistedOperationMiddleware.cs 68 86 79.1% 🔴
…/src/AspNetCore.Pipeline/Utilities/MiddlewareHelper.cs 59 64 92.2% 🟡
…/Execution/Pipeline/OperationExecutionMiddleware.cs 27 29 93.1% 🟡
…/AspNetCore/src/Transport.Http/DefaultGraphQLHttpClient.cs 18 19 94.7% 🟡
…/Extensions/EndpointRouteBuilderExtensions.cs 2 2 100.0% 🟢
…/AspNetCore/src/AspNetCore.Pipeline/HttpQueryMiddleware.cs 65 65 100.0% 🟢
…/src/AspNetCore.Pipeline/HttpUnsupportedRequestMiddleware.cs 29 29 100.0% 🟢
…/AspNetCore/src/AspNetCore.Pipeline/MiddlewareFactory.cs 7 7 100.0% 🟢
…/src/AspNetCore.Pipeline/Options/GraphQLServerOptions.cs 2 2 100.0% 🟢
…/AspNetCore/src/AspNetCore.Pipeline/Utilities/ErrorHelper.cs 12 12 100.0% 🟢
…/AspNetCore/src/Transport.Http/GraphQLHttpMethod.cs 2 2 100.0% 🟢
…/HotChocolateAzureFunctionServiceCollectionExtensions.cs 1 1 100.0% 🟢
…/src/Diagnostics.Core/Spans/Http/ExecuteHttpRequestSpan.cs 2 2 100.0% 🟢
…/Fusion/src/Fusion.Execution/Execution/ErrorHelper.cs 20 20 100.0% 🟢
Uncovered changed lines (JSON)
{
  "sha": "dbb3a287dad5eb3fa0be71d01feb8ef27d4ae038",
  "files": [
    { "path": "src/HotChocolate/AspNetCore/src/Transport.Http/GraphQLHttpClientExtensions.cs", "ranges": [[852, 858], [988, 994], [1028, 1034]] },
    { "path": "src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/PersistedOperationMiddleware.cs", "ranges": [[147, 152], [173, 178], [182, 187]] },
    { "path": "src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/MiddlewareHelper.cs", "ranges": [[210, 214]] },
    { "path": "src/HotChocolate/Fusion/src/Fusion.Execution/Execution/Pipeline/OperationExecutionMiddleware.cs", "ranges": [[149, 150]] },
    { "path": "src/HotChocolate/AspNetCore/src/Transport.Http/DefaultGraphQLHttpClient.cs", "ranges": [[395, 395]] }
  ]
}

Project coverage: 58.4% (294726/504457 lines)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

📚 documentation This issue is about working on our documentation. 🌶️ hot chocolate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants