Hi!
Thank you for the report!

It appears that your reproduction sandbox doesn't exists.

But I can suppose what is the problem here. This behavior only applies to spec compliant requests, which have an accept header value of 'application/json'.

The yoga server tested against the graphql-http spec test suite, so it should be very compliant to the spec :-)

I'm closing this, but if you still think something is wrong, don't hesitate to comment or reopen with an update reproduction case :-)

How frustrating - took ages to create the sandbox.

Leaving that aside, have you read the discussion I linked to graphql/graphql-over-http#288. The basic point is that yoga implements 400 for variables that don't validate against a GraphQL document, whereas the spec writers are quite clear that the 400 is meant only for scenarios where the variables provided do not comply with the general GraphQL spec of what variables can be (e.g. must be an object, not an array). Perhaps the graphql-http test suite has a mistake in it. I will raise your point with them.

Actually reading more about it, the graphql-http project have not actually implemented a test suite to validate against (they have only described it), so perhaps there is a mistake in the implementation of the test suite you reference.

the graphql-http project have not actually implemented a test suite to validate against

The test suite can be found here: https://graphql-http.com/; and here's the report for graphql-yoga: https://github.com/graphql/graphql-http/tree/main/implementations/graphql-yoga

The keyword here is SHOULD, which is a recommendation rather than a requirement (see RFC2119). Returning 400 for variables that do not coerce is valid, but not preferred.

@wheresrhys this is not the case. Maybe you're mixing application/json and application/graphql-response json accept headers; whereas the former should respond with a 200 and the latter with a 400.

Both of these audits pass when using the graphql-http test suite.

Passing

[...]
53. 7B9B SHOULD use a status code of 200 on variable coercion failure when accepting application/json
60. 86EE SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response json

Also, Yoga implements the full graphql-http audit test suite as a part of its own tests. We make sure it's passing on each commit.