dgraph-io/dgraph · error

no query string supplied in request

Error message

no query string supplied in request

What it means

schema.Operation validates an incoming GraphQL request and must find a single valid operation. If the Request is nil or its Query string is empty, there is nothing to parse, so this error is returned before any parsing happens.

Source

Thrown at graphql/schema/request.go:44

}

// RequestExtensions represents extensions recieved in requests
type RequestExtensions struct {
	PersistedQuery PersistedQuery
}

// PersistedQuery represents the query struct received from clients like Apollo
type PersistedQuery struct {
	Sha256Hash string
}

// Operation finds the operation in req, if it is a valid request for GraphQL
// schema s. If the request is GraphQL valid, it must contain a single valid
// Operation.  If either the request is malformed or doesn't contain a valid
// operation, all GraphQL errors encountered are returned.
func (s *schema) Operation(req *Request) (Operation, error) {
	if req == nil || req.Query == "" {
		return nil, errors.New("no query string supplied in request")
	}

	doc, gqlErr := parser.ParseQuery(&ast.Source{Input: req.Query})
	if gqlErr != nil {
		return nil, gqlErr
	}

	listErr := validator.Validate(s.schema, doc, req.Variables)
	if len(listErr) != 0 {
		return nil, listErr
	}

	if len(doc.Operations) == 1 && doc.Operations[0].Operation == ast.Subscription &&
		s.schema.Subscription == nil {
		return nil, errors.Errorf("Not resolving subscription because schema doesn't have any " +
			"fields defined for subscription operation.")
	}

View on GitHub (pinned to 759e242be6)

Solutions

  1. Set req.Query to the GraphQL document string before calling Operation.
  2. Check the HTTP client is actually sending the query (inspect request body / query param).
  3. Return a 400 to the client when the query string is missing instead of retrying.

Example fix

// before
req := &graphQLapi.Request{Variables: vars}
// after
req := &graphQLapi.Request{Query: "{ queryUser { name } }", Variables: vars}
Defensive patterns

Strategy: validation

Validate before calling

func validateGraphQLRequest(req *Request) error {
    if req == nil || strings.TrimSpace(req.Query) == "" {
        return errors.New("request must include a non-empty query")
    }
    return nil
}

Type guard

func hasQuery(req *Request) bool {
    return req != nil && req.Query != ""
}

Try / catch

op, err := schema.Operation(req)
if err != nil {
    if strings.Contains(err.Error(), "no query string supplied") {
        http.Error(w, `{"errors":[{"message":"query is required"}]}`, http.StatusBadRequest)
        return
    }
    http.Error(w, err.Error(), http.StatusInternalServerError)
}

Prevention

When it happens

Trigger: Calling s.Operation(req) with req == nil, or a *graphql.Request whose Query field was never set / set to "" — e.g. posting an empty body or a request that only carried variables.

Common situations: HTTP client POSTs an empty body or JSON without a "query" key; a middleware strips the body; a transport bug sends GET without ?query=; tests constructing Request{} without Query.

Related errors


AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/8e85a9ebd9cba381. Report an issue: GitHub.