99designs / 99designs/gqlgen

Proposal: case-insensitive APQ hash validation

Open
#3,298 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
10.8k
Forks
1.3k
Avg merge
2d 36m
Merged PRs (30d)
26

Description

### What happened?

The server returns an error `provided APQ hash does not match query` even when the queries in question are equal.

This happens because of this line:
https://github.com/99designs/gqlgen/blob/cc177859d901ab166fc2c5d741ace906e91fb225/graphql/handler/extension/apq.go#L85
Here, the internal hash, calculated in `computeQueryHash` is compared with the received hash from the client in `extension.Sha256`.

Here's the problem:
`computeQueryHash` uses `hex.EncodeToString` which always returns **lowercase** hex characters.
**The hash from the client might not be lowercase though.**

In my case, I use the C# client (https://github.com/graphql-dotnet/graphql-client#automatic-persisted-queries-apq) which always returns **uppercase** hashes.

The above-mentioned line in `apq.go` performs a simple string comparison and since `123abc != 123ABC`, it returns an error even if these two hashes are idempotent.

### What did you expect?

Hashes to be compared case-insensitively, e.g. by using [`strings.EqualFold`](https://pkg.go.dev/strings#EqualFold).

I have a fork with this fix ready if feedback on this suggestion is positive (I created this issue first instead of directly raising a PR according to the [contribution guidelines](https://github.com/99designs/gqlgen/blob/master/CONTRIBUTING.md)).

### Minimal graphql.schema and models to reproduce

n/a

### versions
- `gqlgen@v0.17.53`
- `go 1.23.0`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.