Working with GraphQL over HTTP

1. Understanding HTTP Methods

MethodUse
POSTAll operations; body has query/variables
GETQueries only (cacheable, idempotent)
Mutations via GETForbidden by spec

2. Sending Query in Request Body

Example: POST request

fetch("/graphql", {
  method: "POST",
  headers: { "Content-Type": "application/json", "Accept": "application/graphql-response+json" },
  body: JSON.stringify({
    query: "query U($id: ID!) { user(id: $id) { name } }",
    variables: { id: "1" },
    operationName: "U"
  })
});

3. Sending Query in URL

Example: GET request

GET /graphql?query={me{id}}&variables=%7B%7D&operationName=GetMe
ParamEncoding
queryURL-encoded
variablesJSON-encoded then URL-encoded
operationNamePlain string

4. Setting Content-Type Header

HeaderValue
Requestapplication/json
Response (modern)application/graphql-response+json
Response (legacy)application/json
Multipart (defer/stream/uploads)multipart/mixed

5. Handling HTTP Status Codes

StatusMeaning
200Successful execution (may contain errors[])
400Malformed JSON / parse error
401 / 403Auth issues (with graphql-response+json)
405Method not allowed
415Unsupported Content-Type
429Rate limited
500Internal server error

6. Using Accept Header

AcceptBehavior
application/graphql-response+jsonModern; status reflects errors
application/jsonLegacy; always 200 on validation/exec errors
multipart/mixedEnable @defer / @stream
text/event-streamSSE subscriptions

7. Implementing CORS

Example: Express CORS

import cors from "cors";

app.use(cors({
  origin: ["https://app.example.com"],
  credentials: true,
  allowedHeaders: ["Content-Type", "Authorization", "Apollo-Require-Preflight"],
  methods: ["POST", "GET", "OPTIONS"]
}));

8. Using GraphQL Endpoint

ConventionDetail
Path/graphql
VersioningAvoid /v1/graphql; evolve schema instead
Subscriptions/graphql upgrade to ws

9. Batching HTTP Requests

FormatDetail
Request bodyArray of operation objects
ResponseParallel array of responses
Trade-offLower RTT cost; head-of-line blocking risk

10. Implementing Compression

EncodingDetail
gzipWide support, decent ratio
brotliBetter ratio for text
Apply toBoth request (rare) and response (common)