🌍 Spec-compliant and production ready JavaScript GraphQL server that lets you develop in a schema-first way. Built for Express, Connect, Hapi, Koa, and more.
Installations
npm install @apollo/server
Score
63.8
Supply Chain
94.3
Quality
89.3
Maintenance
100
Vulnerability
98.9
License
Releases
@apollo/server@4.11.2
Published on 29 Oct 2024
@apollo/server-integration-testsuite@4.11.2
Published on 29 Oct 2024
@apollo/server@4.11.1
Published on 29 Oct 2024
@apollo/server-integration-testsuite@4.11.1
Published on 29 Oct 2024
@apollo/server@4.11.0
Published on 08 Aug 2024
@apollo/server-integration-testsuite@4.11.0
Published on 08 Aug 2024
Developer
Developer Guide
Module System
ESM
Min. Node Version
>=14.16.0
Typescript Support
Yes
Node Version
22.11.0
NPM Version
10.9.0
Statistics
13,805 Stars
8,411 Commits
2,029 Forks
204 Watching
88 Branches
575 Contributors
Updated on 27 Nov 2024
Bundle Size
130.56 kB
Minified
36.15 kB
Minified + Gzipped
Languages
TypeScript (55.93%)
JavaScript (43.61%)
Shell (0.45%)
Total Downloads
Cumulative downloads
Total Downloads
66,681,518
Last day
-0.2%
215,095
Compared to previous day
Last week
5.5%
1,140,894
Compared to previous week
Last month
12.8%
4,714,933
Compared to previous month
Last year
126.5%
46,122,656
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
24
Peer Dependencies
1
@apollo/server
This
@apollo/server
package is new with Apollo Server 4. Previous major versions of Apollo Server used a set of package names starting withapollo-server
, such asapollo-server
,apollo-server-express
,apollo-server-core
, etc.
Announcement:
Join 1000+ engineers at GraphQL Summit for talks, workshops, and office hours, Oct 8-10 in NYC. Get your pass here ->
A TypeScript/JavaScript GraphQL server
Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. It's the best way to build a production-ready, self-documenting GraphQL API that can use data from any source.
You can use Apollo Server as:
- A stand-alone GraphQL server
- The GraphQL server for a subgraph in a federated supergraph
- The gateway for a federated supergraph
Apollo Server provides a simple API for integrating with any Node.js web framework or serverless environment. The @apollo/server
package itself ships with a minimally-configurable, standalone web server which handles CORS and body parsing out of the box. Integrations with other environments are community-maintained.
Apollo Server provides:
- Straightforward setup, so your client developers can start fetching data quickly
- Incremental adoption, enabling you to add features as they're needed
- Universal compatibility with any data source, any build tool, and any GraphQL client
- Production readiness, enabling you to confidently run your graph in production
Documentation
Full documentation for Apollo Server is available on our documentation site. This README shows the basics of getting a server running (both standalone and with Express), but most features are only documented on our docs site.
Getting started: standalone server
You can also check out the getting started guide in the Apollo Server docs for more details, including examples in both TypeScript and JavaScript.
Apollo Server's standalone server lets you get a GraphQL server up and running quickly without needing to set up an HTTP server yourself. It allows all the same configuration of GraphQL logic as the Express integration, but does not provide the ability to make fine-grained tweaks to the HTTP-specific behavior of your server.
First, install Apollo Server and the JavaScript implementation of the core GraphQL algorithms:
npm install @apollo/server graphql
Then, write the following to server.mjs
. (By using the .mjs
extension, Node lets you use the await
keyword at the top level.)
1import { ApolloServer } from '@apollo/server'; 2import { startStandaloneServer } from '@apollo/server/standalone'; 3 4// The GraphQL schema 5const typeDefs = `#graphql 6 type Query { 7 hello: String 8 } 9`; 10 11// A map of functions which return data for the schema. 12const resolvers = { 13 Query: { 14 hello: () => 'world', 15 }, 16}; 17 18const server = new ApolloServer({ 19 typeDefs, 20 resolvers, 21}); 22 23const { url } = await startStandaloneServer(server); 24console.log(`🚀 Server ready at ${url}`);
Now run your server with:
node server.mjs
Open the URL it prints in a web browser. It will show Apollo Sandbox, a web-based tool for running GraphQL operations. Try running the operation query { hello }
!
Getting started: Express middleware
Apollo Server's built-in Express middleware lets you run your GraphQL server as part of an app built with Express, the most popular web framework for Node.
First, install Apollo Server, the JavaScript implementation of the core GraphQL algorithms, Express, and two common Express middleware packages:
npm install @apollo/server graphql express cors body-parser
If using Typescript you may also need to install additional type declaration packages as development dependencies to avoid common errors when importing the above packages (i.e. Could not find a declaration file for module 'cors
'):
npm install --save-dev @types/cors @types/express @types/body-parser
Then, write the following to server.mjs
. (By using the .mjs
extension, Node lets you use the await
keyword at the top level.)
1import { ApolloServer } from '@apollo/server'; 2import { expressMiddleware } from '@apollo/server/express4'; 3import { ApolloServerPluginDrainHttpServer } from '@apollo/server/plugin/drainHttpServer' 4import express from 'express'; 5import http from 'http'; 6import cors from 'cors'; 7import bodyParser from 'body-parser'; 8 9// The GraphQL schema 10const typeDefs = `#graphql 11 type Query { 12 hello: String 13 } 14`; 15 16// A map of functions which return data for the schema. 17const resolvers = { 18 Query: { 19 hello: () => 'world', 20 }, 21}; 22 23const app = express(); 24const httpServer = http.createServer(app); 25 26// Set up Apollo Server 27const server = new ApolloServer({ 28 typeDefs, 29 resolvers, 30 plugins: [ApolloServerPluginDrainHttpServer({ httpServer })], 31}); 32await server.start(); 33 34app.use( 35 cors(), 36 bodyParser.json(), 37 expressMiddleware(server), 38); 39 40await new Promise((resolve) => httpServer.listen({ port: 4000 }, resolve)); 41console.log(`🚀 Server ready at http://localhost:4000`);
Now run your server with:
node server.mjs
Open the URL it prints in a web browser. It will show Apollo Sandbox, a web-based tool for running GraphQL operations. Try running the operation query { hello }
!
Stable Version
The latest stable version of the package.
Stable Version
4.11.2
MODERATE
1
0/10
Summary
Batched HTTP requests may set incorrect `cache-control` response header
Affected Versions
< 4.1.0
Patched Versions
4.1.0
LOW
2
0/10
Summary
Prevent logging invalid header values
Affected Versions
< 4.9.3
Patched Versions
4.9.3
0/10
Summary
@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces
Affected Versions
>= 4.7.1, < 4.7.4
Patched Versions
4.7.4
Reason
30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/apollographql/.github/SECURITY.md:1
- Info: Found linked content: github.com/apollographql/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/apollographql/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/apollographql/.github/SECURITY.md:1
Reason
Found 2/21 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: found token with 'none' permissions: .github/workflows/lock.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-pr.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/apollographql/apollo-server/lock.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-pr.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/apollographql/apollo-server/release-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-pr.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/apollographql/apollo-server/release-pr.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-pr.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/apollographql/apollo-server/release-pr.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: smoke-test/prepare.sh:17
- Warn: npmCommand not pinned by hash: smoke-test/prepare.sh:22
- Warn: npmCommand not pinned by hash: smoke-test/prepare.sh:26
- Warn: npmCommand not pinned by hash: smoke-test/smoke-test.sh:71
- Warn: npmCommand not pinned by hash: .github/workflows/release-pr.yml:27
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 0 out of 5 npmCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 22 are checked with a SAST tool
Reason
15 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-f6v4-cf5j-vf3w
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-q674-xm3x-2926
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-5r9g-qh6m-jxff
- Warn: Project is vulnerable to: GHSA-r6ch-mqf9-qc9w
- Warn: Project is vulnerable to: GHSA-wqq4-5wpv-mx2g
- Warn: Project is vulnerable to: GHSA-3787-6prv-h9w3
- Warn: Project is vulnerable to: GHSA-9qxr-qj54-h672
- Warn: Project is vulnerable to: GHSA-m4v8-wqvr-p9f7
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Score
4.5
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to @apollo/server
@apollo/server-gateway-interface
Interface used to connect Apollo Gateway to Apollo Server
apollo-server-testing
Test utils for apollo-server
@apollo/cache-control-types
TypeScript types for Apollo Server info.cacheControl
@apollo/server-plugin-response-cache
Apollo Server full query response cache