graphql-http 1.17.1 → 1.19.0

package/lib/audits/server.mjs

@@ -54,9 +54,13 @@ export function serverAudits(opts) {
             ressert(res).header('content-type').toContain('application/json');
         }),
         audit('80D8', 'SHOULD assume application/json content-type when accept is missing', async () => {
-            const url = new URL(await getUrl(opts.url));
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString());
+            const res = await fetchFn(await getUrl(opts.url), {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
             ressert(res).status.toBe(200);
             ressert(res).header('content-type').toContain('application/json');
         }),
@@ -127,7 +131,7 @@ export function serverAudits(opts) {
             ressert(res).status.toBeBetween(400, 499);
         }),
         // Request POST
-        audit('9ABE', 'SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
+        audit('9ABE', 'MAY respond with 4xx status code if content-type is not supplied on POST requests', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
             });
@@ -141,23 +145,15 @@ export function serverAudits(opts) {
             });
             ressert(res).status.toBe(200);
         }),
-        audit('7267', 'MUST require a request body on POST', async () => {
-            var _a;
+        audit('A5BF', 'MAY use 400 status code when request body is missing on POST', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
             });
-            if ((_a = res.headers.get('content-type')) === null || _a === void 0 ? void 0 : _a.includes('application/json')) {
-                await ressert(res).bodyAsExecutionResult.toHaveProperty('errors');
-            }
-            else {
-                ressert(res).status.toBe(400);
-            }
+            ressert(res).status.toBe(400);
         }),
         // Request Parameters
-        audit(
-        // TODO: convert to MUST after watershed
-        '6610', 'SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json', async () => {
+        audit('423L', 'MAY use 400 status code on missing {query} parameter', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
@@ -168,26 +164,11 @@ export function serverAudits(opts) {
             });
             ressert(res).status.toBe(400);
         }),
-        audit('3715', 'SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json', async () => {
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`LKJ${index}`, `MAY use 400 status code on ${extendedTypeof(invalid)} {query} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({ notquery: '{ __typename }' }),
-            });
-            ressert(res).status.toBe(200);
-            await ressert(res).bodyAsExecutionResult.toHaveProperty('errors');
-        }),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`4F5${index}`, 
-        // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${extendedTypeof(invalid)} {query} parameter when accepting application/graphql-response+json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     query: invalid,
@@ -195,20 +176,6 @@ export function serverAudits(opts) {
             });
             ressert(res).status.toBe(400);
         })),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`9FE${index}`, `SHOULD use 200 status code with errors field on ${extendedTypeof(invalid)} {query} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    query: invalid,
-                }),
-            });
-            ressert(res).status.toBe(200);
-            await ressert(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         audit(
         // TODO: convert to MUST after watershed
         '34A2', 'SHOULD allow string {query} parameter when accepting application/graphql-response+json', async () => {
@@ -238,14 +205,11 @@ export function serverAudits(opts) {
             ressert(res).status.toBe(200);
             await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`E3E${index}`, 
-        // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${extendedTypeof(invalid)} {operationName} parameter when accepting application/graphql-response+json`, async () => {
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`6C0${index}`, `MAY use 400 status code on ${extendedTypeof(invalid)} {operationName} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     operationName: invalid,
@@ -254,21 +218,6 @@ export function serverAudits(opts) {
             });
             ressert(res).status.toBe(400);
         })),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`FB9${index}`, `SHOULD use 200 status code with errors field on ${extendedTypeof(invalid)} {operationName} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    operationName: invalid,
-                    query: '{ __typename }',
-                }),
-            });
-            ressert(res).status.toBe(200);
-            await ressert(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         audit(
         // TODO: convert to MUST after watershed
         '8161', 'SHOULD allow string {operationName} parameter when accepting application/graphql-response+json', async () => {
@@ -334,14 +283,11 @@ export function serverAudits(opts) {
                 await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
             }),
         ]),
-        ...['string', 0, false, ['array']].map((invalid, index) => audit(`69B${index}`, 
-        // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${extendedTypeof(invalid)} {variables} parameter when accepting application/graphql-response+json`, async () => {
+        ...['string', 0, false, ['array']].map((invalid, index) => audit(`476${index}`, `MAY use 400 status code on ${extendedTypeof(invalid)} {variables} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     query: '{ __typename }',
@@ -350,21 +296,6 @@ export function serverAudits(opts) {
             });
             ressert(res).status.toBe(400);
         })),
-        ...['string', 0, false, ['array']].map((invalid, index) => audit(`F05${index}`, `SHOULD use 200 status code with errors field on ${extendedTypeof(invalid)} {variables} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    query: '{ __typename }',
-                    variables: invalid,
-                }),
-            });
-            ressert(res).status.toBe(200);
-            await ressert(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         audit(
         // TODO: convert to MUST after watershed
         '2EA1', 'SHOULD allow map {variables} parameter when accepting application/graphql-response+json', async () => {
@@ -421,14 +352,13 @@ export function serverAudits(opts) {
             ressert(res).status.toBe(200);
             await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        ...['string', 0, false, ['array']].map((invalid, index) => audit(`904${index}`, 
+        ...['string', 0, false, ['array']].map((invalid, index) => audit(`58B${index}`, 
         // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${extendedTypeof(invalid)} {extensions} parameter when accepting application/graphql-response+json`, async () => {
+        `MAY use 400 status code on ${extendedTypeof(invalid)} {extensions} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     query: '{ __typename }',
@@ -437,21 +367,6 @@ export function serverAudits(opts) {
             });
             ressert(res).status.toBe(400);
         })),
-        ...['string', 0, false, ['array']].map((invalid, index) => audit(`368${index}`, `SHOULD use 200 status code with errors field on ${extendedTypeof(invalid)} {extensions} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    query: '{ __typename }',
-                    extensions: invalid,
-                }),
-            });
-            ressert(res).status.toBe(200);
-            await ressert(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         audit(
         // TODO: convert to MUST after watershed
         '428F', 'SHOULD allow map {extensions} parameter when accepting application/graphql-response+json', async () => {
@@ -483,136 +398,91 @@ export function serverAudits(opts) {
             ressert(res).status.toBe(200);
             await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        // TODO: audit('39AA', 'MUST accept a map for the {extensions} parameter'),
-        // Response application/json
-        audit('D477', 'SHOULD use 200 status code on JSON parsing failure when accepting application/json', async () => {
+        audit('B6DC', 'MAY use 4xx or 5xx status codes on JSON parsing failure', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
                 body: '{ "not a JSON',
             });
-            ressert(res).status.toBe(200);
-        }),
-        audit('F5AF', 'SHOULD use 200 status code if parameters are invalid when accepting application/json', async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    qeury: /* typo */ '{ __typename }',
-                }),
-            });
-            ressert(res).status.toBe(200);
+            ressert(res).status.toBeBetween(400, 499);
         }),
-        audit('572B', 'SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
+        audit('BCF8', 'MAY use 400 status code on JSON parsing failure', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
-                body: JSON.stringify({ query: '{' }),
+                body: '{ "not a JSON',
             });
-            ressert(res).status.toBe(200);
+            ressert(res).status.toBe(400);
         }),
-        audit('FDE2', 'SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
+        audit('8764', 'MAY use 4xx or 5xx status codes if parameters are invalid', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                    qeury /* typo */: '{ __typename }',
                 }),
             });
-            ressert(res).status.toBe(200);
+            ressert(res).status.toBeBetween(400, 599);
         }),
-        audit('7B9B', 'SHOULD use a status code of 200 on variable coercion failure when accepting application/json', async () => {
+        audit('3E3A', 'MAY use 400 status code if parameters are invalid', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    query: 'query CoerceFailure($id: ID!){ __typename }',
-                    variables: { id: null },
+                    qeury: /* typo */ '{ __typename }',
                 }),
             });
-            ressert(res).status.toBe(200);
-        }),
-        // Response application/graphql-response+json
-        audit(
-        // TODO: convert to MUST after watershed
-        '60AA', 'SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json', async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
-                },
-                body: '{ "not a JSON',
-            });
-            ressert(res).status.toBeBetween(400, 499);
-        }),
-        audit('2163', 'SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
-                },
-                body: '{ "not a JSON',
-            });
             ressert(res).status.toBe(400);
         }),
-        audit(
-        // TODO: convert to MUST after watershed
-        '3E36', 'SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
+        // TODO: audit('39AA', 'MUST accept a map for the {extensions} parameter'),
+        // Response application/json
+        audit('572B', 'SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
+                    accept: 'application/json',
                 },
-                body: JSON.stringify({
-                    qeury /* typo */: '{ __typename }',
-                }),
+                body: JSON.stringify({ query: '{' }),
             });
-            ressert(res).status.toBeBetween(400, 599);
+            ressert(res).status.toBe(200);
         }),
-        audit('17C5', 'SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json', async () => {
+        audit('FDE2', 'SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
+                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    qeury: /* typo */ '{ __typename }',
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
                 }),
             });
-            ressert(res).status.toBe(400);
+            ressert(res).status.toBe(200);
         }),
-        audit('34D6', 'SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json', async () => {
+        audit('7B9B', 'SHOULD use a status code of 200 on variable coercion failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
+                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    qeury: /* typo */ '{ __typename }',
+                    query: 'query CoerceFailure($id: ID!){ __typename }',
+                    variables: { id: null },
                 }),
             });
-            await ressert(res).bodyAsExecutionResult.data.toBe(undefined);
+            ressert(res).status.toBe(200);
         }),
+        // Response application/graphql-response+json
         audit(
         // TODO: convert to MUST after watershed
         '865D', 'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {

package/lib/audits/utils.js

@@ -48,10 +48,13 @@ function audit(id, name, fn) {
                     id,
                     name,
                     status: name.startsWith('MUST')
-                        ? // only failing MUSTs are considered errors
+                        ? // failing MUSTs are considered errors
                             'error'
-                        : // everything else is optional and considered a warning
-                            'warn',
+                        : name.startsWith('SHOULD')
+                            ? // recommendations are warnings
+                                'warn'
+                            : // everything else is truly optional
+                                'notice',
                     reason: err.reason,
                     response: err.response,
                 };

package/lib/audits/utils.mjs

@@ -31,10 +31,13 @@ export function audit(id, name, fn) {
                     id,
                     name,
                     status: name.startsWith('MUST')
-                        ? // only failing MUSTs are considered errors
+                        ? // failing MUSTs are considered errors
                             'error'
-                        : // everything else is optional and considered a warning
-                            'warn',
+                        : name.startsWith('SHOULD')
+                            ? // recommendations are warnings
+                                'warn'
+                            : // everything else is truly optional
+                                'notice',
                     reason: err.reason,
                     response: err.response,
                 };

package/lib/handler.d.mts

@@ -101,6 +101,12 @@ export declare function isResponse(val: unknown): val is Response;
  * @category Server
  */
 export type OperationContext = Record<PropertyKey, unknown> | symbol | number | string | boolean | undefined | null;
+/**
+ * The (GraphQL) error formatter function.
+ *
+ * @category Server
+ */
+export type FormatError = (err: Readonly<GraphQLError | Error>) => GraphQLError | Error;
 /** @category Server */
 export type OperationArgs<Context extends OperationContext = undefined> = ExecutionArgs & {
     contextValue?: Context;
@@ -215,6 +221,14 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
      * further execution.
      */
     onOperation?: (req: Request<RequestRaw, RequestContext>, args: OperationArgs<Context>, result: ExecutionResult) => Promise<ExecutionResult | Response | void> | ExecutionResult | Response | void;
+    /**
+     * Format handled errors to your satisfaction. Either GraphQL errors
+     * or safe request processing errors are meant by "handleded errors".
+     *
+     * If multiple errors have occured, all of them will be mapped using
+     * this formatter.
+     */
+    formatError?: FormatError;
 }
 /**
  * The ready-to-use handler. Simply plug it in your favourite HTTP framework
@@ -301,9 +315,12 @@ export declare function getAcceptableMediaType(acceptHeader: string | null | und
  *
  * If the first argument is an `ExecutionResult`, the operation will be treated as "successful".
  *
- * If the first argument is _any_ object without the `data` field, it will be treated as an error (as per the spec)
- * and the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ * If the first argument is (an array of) `GraphQLError`, or an `ExecutionResult` without the `data` field, it will be treated
+ * the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ *
+ * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
+ * error will be present in the `ExecutionResult` style.
  *
  * @category Server
  */
-export declare function makeResponse(resultOrErrors: Readonly<ExecutionResult> | Readonly<GraphQLError[]> | Readonly<GraphQLError>, acceptedMediaType: AcceptableMediaType): Response;
+export declare function makeResponse(resultOrErrors: Readonly<ExecutionResult> | Readonly<GraphQLError[]> | Readonly<GraphQLError> | Readonly<Error>, acceptedMediaType: AcceptableMediaType, formatError: FormatError): Response;

package/lib/handler.d.ts

@@ -101,6 +101,12 @@ export declare function isResponse(val: unknown): val is Response;
  * @category Server
  */
 export type OperationContext = Record<PropertyKey, unknown> | symbol | number | string | boolean | undefined | null;
+/**
+ * The (GraphQL) error formatter function.
+ *
+ * @category Server
+ */
+export type FormatError = (err: Readonly<GraphQLError | Error>) => GraphQLError | Error;
 /** @category Server */
 export type OperationArgs<Context extends OperationContext = undefined> = ExecutionArgs & {
     contextValue?: Context;
@@ -215,6 +221,14 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
      * further execution.
      */
     onOperation?: (req: Request<RequestRaw, RequestContext>, args: OperationArgs<Context>, result: ExecutionResult) => Promise<ExecutionResult | Response | void> | ExecutionResult | Response | void;
+    /**
+     * Format handled errors to your satisfaction. Either GraphQL errors
+     * or safe request processing errors are meant by "handleded errors".
+     *
+     * If multiple errors have occured, all of them will be mapped using
+     * this formatter.
+     */
+    formatError?: FormatError;
 }
 /**
  * The ready-to-use handler. Simply plug it in your favourite HTTP framework
@@ -301,9 +315,12 @@ export declare function getAcceptableMediaType(acceptHeader: string | null | und
  *
  * If the first argument is an `ExecutionResult`, the operation will be treated as "successful".
  *
- * If the first argument is _any_ object without the `data` field, it will be treated as an error (as per the spec)
- * and the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ * If the first argument is (an array of) `GraphQLError`, or an `ExecutionResult` without the `data` field, it will be treated
+ * the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ *
+ * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
+ * error will be present in the `ExecutionResult` style.
  *
  * @category Server
  */
-export declare function makeResponse(resultOrErrors: Readonly<ExecutionResult> | Readonly<GraphQLError[]> | Readonly<GraphQLError>, acceptedMediaType: AcceptableMediaType): Response;
+export declare function makeResponse(resultOrErrors: Readonly<ExecutionResult> | Readonly<GraphQLError[]> | Readonly<GraphQLError> | Readonly<Error>, acceptedMediaType: AcceptableMediaType, formatError: FormatError): Response;

package/lib/handler.js

@@ -76,7 +76,7 @@ exports.isResponse = isResponse;
  * @category Server
  */
 function createHandler(options) {
-    const { schema, context, validate = graphql_1.validate, validationRules = [], execute = graphql_1.execute, parse = graphql_1.parse, getOperationAST = graphql_1.getOperationAST, rootValue, onSubscribe, onOperation, } = options;
+    const { schema, context, validate = graphql_1.validate, validationRules = [], execute = graphql_1.execute, parse = graphql_1.parse, getOperationAST = graphql_1.getOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, } = options;
     return async function handler(req) {
         var _a, _b;
         const method = req.method;
@@ -177,6 +177,10 @@ function createHandler(options) {
                     Array.isArray(partParams.variables))) {
                 throw new Error('Invalid variables');
             }
+            if (partParams.operationName != null &&
+                typeof partParams.operationName !== 'string') {
+                throw new Error('Invalid operationName');
+            }
             if (partParams.extensions != null &&
                 (typeof partParams.extensions !== 'object' ||
                     Array.isArray(partParams.extensions))) {
@@ -186,7 +190,7 @@ function createHandler(options) {
             params = partParams;
         }
         catch (err) {
-            return makeResponse(new graphql_1.GraphQLError(err.message), acceptedMediaType);
+            return makeResponse(err, acceptedMediaType, formatError);
         }
         let args;
         const maybeResErrsOrArgs = await (onSubscribe === null || onSubscribe === void 0 ? void 0 : onSubscribe(req, params));
@@ -194,7 +198,7 @@ function createHandler(options) {
             return maybeResErrsOrArgs;
         else if ((0, utils_1.isExecutionResult)(maybeResErrsOrArgs) ||
             (0, utils_1.areGraphQLErrors)(maybeResErrsOrArgs))
-            return makeResponse(maybeResErrsOrArgs, acceptedMediaType);
+            return makeResponse(maybeResErrsOrArgs, acceptedMediaType, formatError);
         else if (maybeResErrsOrArgs)
             args = maybeResErrsOrArgs;
         else {
@@ -206,7 +210,7 @@ function createHandler(options) {
                 document = parse(query);
             }
             catch (err) {
-                return makeResponse(err, acceptedMediaType);
+                return makeResponse(err, acceptedMediaType, formatError);
             }
             const resOrContext = typeof context === 'function' ? await context(req, params) : context;
             if (isResponse(resOrContext))
@@ -235,7 +239,7 @@ function createHandler(options) {
             }
             const validationErrs = validate(args.schema, args.document, rules);
             if (validationErrs.length) {
-                return makeResponse(validationErrs, acceptedMediaType);
+                return makeResponse(validationErrs, acceptedMediaType, formatError);
             }
         }
         let operation;
@@ -246,10 +250,10 @@ function createHandler(options) {
             operation = ast.operation;
         }
         catch (_d) {
-            return makeResponse(new graphql_1.GraphQLError('Unable to detect operation AST'), acceptedMediaType);
+            return makeResponse(new graphql_1.GraphQLError('Unable to detect operation AST'), acceptedMediaType, formatError);
         }
         if (operation === 'subscription') {
-            return makeResponse(new graphql_1.GraphQLError('Subscriptions are not supported'), acceptedMediaType);
+            return makeResponse(new graphql_1.GraphQLError('Subscriptions are not supported'), acceptedMediaType, formatError);
         }
         // mutations cannot happen over GETs
         // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
@@ -283,9 +287,9 @@ function createHandler(options) {
         else if (maybeResponseOrResult)
             result = maybeResponseOrResult;
         if ((0, utils_1.isAsyncIterable)(result)) {
-            return makeResponse(new graphql_1.GraphQLError('Subscriptions are not supported'), acceptedMediaType);
+            return makeResponse(new graphql_1.GraphQLError('Subscriptions are not supported'), acceptedMediaType, formatError);
         }
-        return makeResponse(result, acceptedMediaType);
+        return makeResponse(result, acceptedMediaType, formatError);
     };
 }
 exports.createHandler = createHandler;
@@ -327,12 +331,29 @@ exports.getAcceptableMediaType = getAcceptableMediaType;
  *
  * If the first argument is an `ExecutionResult`, the operation will be treated as "successful".
  *
- * If the first argument is _any_ object without the `data` field, it will be treated as an error (as per the spec)
- * and the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ * If the first argument is (an array of) `GraphQLError`, or an `ExecutionResult` without the `data` field, it will be treated
+ * the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ *
+ * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
+ * error will be present in the `ExecutionResult` style.
  *
  * @category Server
  */
-function makeResponse(resultOrErrors, acceptedMediaType) {
+function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
+    if (resultOrErrors instanceof Error &&
+        // because GraphQLError extends the Error class
+        !(0, utils_1.isGraphQLError)(resultOrErrors)) {
+        return [
+            JSON.stringify({ errors: [formatError(resultOrErrors)] }, utils_1.jsonErrorReplacer),
+            {
+                status: 400,
+                statusText: 'Bad Request',
+                headers: {
+                    'content-type': 'application/json; charset=utf-8',
+                },
+            },
+        ];
+    }
     const errors = (0, utils_1.isGraphQLError)(resultOrErrors)
         ? [resultOrErrors]
         : (0, utils_1.areGraphQLErrors)(resultOrErrors)
@@ -340,7 +361,7 @@ function makeResponse(resultOrErrors, acceptedMediaType) {
             : null;
     if (errors) {
         return [
-            JSON.stringify({ errors }),
+            JSON.stringify({ errors: errors.map(formatError) }, utils_1.jsonErrorReplacer),
             Object.assign(Object.assign({}, (acceptedMediaType === 'application/json'
                 ? {
                     status: 200,
@@ -357,7 +378,8 @@ function makeResponse(resultOrErrors, acceptedMediaType) {
         ];
     }
     return [
-        JSON.stringify(resultOrErrors),
+        JSON.stringify('errors' in resultOrErrors && resultOrErrors.errors
+            ? Object.assign(Object.assign({}, resultOrErrors), { errors: resultOrErrors.errors.map(formatError) }) : resultOrErrors, utils_1.jsonErrorReplacer),
         {
             status: 200,
             statusText: 'OK',