Updates.

execute_query.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"os"
 	"time"
 	"unicode/utf8"
 
@@ -16,6 +17,8 @@ import (
 	libpack_logger "github.com/lukaszraczylo/go-simple-graphql/logging"
 )
 
+// Size limit constants are defined in query.go
+
 // min returns the smaller of two integers
 func min(a, b int) int {
 	if a < b {
@@ -32,23 +35,38 @@ func max(a, b int) int {
 	return b
 }
 
-var (
-	// Shared HTTP transport with optimized settings
-	defaultTransport = &http.Transport{
-		MaxIdleConns:        100,
-		MaxIdleConnsPerHost: 100,
-		IdleConnTimeout:     90 * time.Second,
-		DisableCompression:  true, // Disable automatic request compression to prevent "trailing garbage" errors
-		ForceAttemptHTTP2:   true,
-		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true}, // Skip TLS verification for test environments
+// getDefaultClient creates a default HTTP client with optimized settings
+// This is called dynamically to ensure environment variables are read at runtime
+func getDefaultClient() *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			MaxIdleConns:        100,
+			MaxIdleConnsPerHost: 100,
+			IdleConnTimeout:     90 * time.Second,
+			DisableCompression:  true, // Disable automatic request compression to prevent "trailing garbage" errors
+			ForceAttemptHTTP2:   true,
+			TLSClientConfig:     getTLSConfig(),
+		},
+		Timeout: 30 * time.Second,
+	}
+}
+
+// getTLSConfig returns TLS configuration based on environment settings
+// By default, TLS verification is enabled for security.
+// Set GRAPHQL_INSECURE_SKIP_VERIFY=true to disable verification (NOT RECOMMENDED for production)
+func getTLSConfig() *tls.Config {
+	skipVerify := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") == "true"
+
+	if skipVerify {
+		// Log warning when running in insecure mode
+		fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification is disabled. This is insecure and should not be used in production.\n")
 	}
 
-	// Shared HTTP client with timeouts
-	defaultClient = &http.Client{
-		Transport: defaultTransport,
-		Timeout:   30 * time.Second,
+	return &tls.Config{
+		InsecureSkipVerify: skipVerify,
+		MinVersion:         tls.VersionTLS12, // Enforce minimum TLS 1.2 for security
 	}
-)
+}
 
 func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 	// Reuse buffer from pool to avoid allocations
@@ -58,7 +76,10 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 
 	buf.Write(qe.Query)
 
-	httpRequest, err := http.NewRequest(http.MethodPost, qe.endpoint, nil)
+	qe.mu.RLock()
+	endpoint := qe.endpoint
+	qe.mu.RUnlock()
+	httpRequest, err := http.NewRequest(http.MethodPost, endpoint, nil)
 	if err != nil {
 		qe.Logger.Error(&libpack_logger.LogMessage{
 			Message: "Can't create HTTP request",
@@ -82,7 +103,9 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 
 	retriesMax := 1
 	if qe.Retries {
+		qe.mu.RLock()
 		retriesMax = qe.retries_number
+		qe.mu.RUnlock()
 	}
 
 	var queryResult queryResults
@@ -100,8 +123,8 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 					"body_size":          len(requestBody),
 					"contains_jsonQuery": bytes.Contains(requestBody, []byte(`"jsonQuery"`)),
 					"contains_base64":    bytes.Contains(requestBody, []byte("eyJ")),
-					"first_100_chars":    string(requestBody[:min(100, len(requestBody))]),
-					"last_50_chars":      string(requestBody[max(0, len(requestBody)-50):]),
+					"first_100_chars":    sanitizeForLogging(string(requestBody[:min(100, len(requestBody))])),
+					"last_50_chars":      sanitizeForLogging(string(requestBody[max(0, len(requestBody)-50):])),
 					"is_valid_utf8":      utf8.Valid(requestBody),
 					"has_null_bytes":     bytes.Contains(requestBody, []byte{0}),
 					"has_control_chars":  hasControlChars(requestBody),
@@ -132,9 +155,11 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 			})
 
 			// Use default client if custom client is not set
+			qe.mu.RLock()
 			client := qe.client
+			qe.mu.RUnlock()
 			if client == nil {
-				client = defaultClient
+				client = getDefaultClient()
 			}
 			httpResponse, err := client.Do(httpRequest)
 			if err != nil {
@@ -159,16 +184,32 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 				},
 			})
 
-			// First, read the entire response body into a buffer
+			// Check Content-Length header if available for early size validation
+			if contentLength := httpResponse.ContentLength; contentLength > 0 && contentLength > MaxResponseSize {
+				return fmt.Errorf("response size %d exceeds maximum allowed size of %d bytes", contentLength, MaxResponseSize)
+			}
+
+			// First, read the entire response body into a buffer with size limit
 			rawBuf := bufferPool.Get().(*bytes.Buffer)
 			rawBuf.Reset()
 			defer bufferPool.Put(rawBuf)
 
-			_, err = io.Copy(rawBuf, httpResponse.Body)
+			// Use LimitedReader to prevent reading more than MaxResponseSize
+			limitedReader := &io.LimitedReader{
+				R: httpResponse.Body,
+				N: MaxResponseSize + 1, // Read one extra byte to detect oversized responses
+			}
+
+			n, err := io.Copy(rawBuf, limitedReader)
 			if err != nil {
 				return fmt.Errorf("error reading HTTP response body: %w", err)
 			}
 
+			// Check if response exceeded size limit
+			if n > MaxResponseSize {
+				return fmt.Errorf("response size exceeds maximum allowed size of %d bytes", MaxResponseSize)
+			}
+
 			rawData := rawBuf.Bytes()
 			qe.Logger.Debug(&libpack_logger.LogMessage{
 				Message: "Read raw response data",
@@ -341,7 +382,11 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) {
 		}),
 		retry.Attempts(uint(retriesMax)),
 		retry.DelayType(retry.BackOffDelay),
-		retry.Delay(time.Duration(qe.retries_delay)),
+		retry.Delay(func() time.Duration {
+			qe.mu.RLock()
+			defer qe.mu.RUnlock()
+			return qe.retries_delay
+		}()),
 		retry.MaxDelay(10*time.Second),
 		retry.LastErrorOnly(true),
 	)

http.go

@@ -2,7 +2,9 @@ package gql
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -10,7 +12,7 @@ import (
 	"golang.org/x/net/http2"
 )
 
-func (b *BaseClient) createHttpClient() (http_client *http.Client) {
+func (b *BaseClient) createHttpClient() (*http.Client, error) {
 	// Optimized connection pool settings for better performance
 	httpTransport := &http.Transport{
 		MaxIdleConns:          100,              // Reduced from 512
@@ -24,7 +26,14 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) {
 		ReadBufferSize:        4096, // Optimize buffer size
 	}
 
-	if strings.HasPrefix(b.endpoint, "http://") {
+	var http_client *http.Client
+
+	// Protect read of endpoint field
+	b.mu.RLock()
+	endpoint := b.endpoint
+	b.mu.RUnlock()
+
+	if strings.HasPrefix(endpoint, "http://") {
 		http_client = &http.Client{
 			Timeout:   30 * time.Second, // Increased for better reliability
 			Transport: httpTransport,
@@ -36,10 +45,12 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) {
 			Message: "Using HTTP/1.1 over http",
 			Pairs:   nil,
 		})
-	} else if strings.HasPrefix(b.endpoint, "https://") {
-		tlsClientConfig := &tls.Config{}
-		if strings.HasPrefix(b.endpoint, "https://") {
-			tlsClientConfig.InsecureSkipVerify = true
+	} else if strings.HasPrefix(endpoint, "https://") {
+		tlsClientConfig := getHTTPClientTLSConfig()
+		if strings.HasPrefix(endpoint, "https://") && tlsClientConfig.InsecureSkipVerify {
+			b.Logger.Warning(&libpack_logger.LogMessage{
+				Message: "TLS certificate verification is disabled. This is insecure and should not be used in production.",
+			})
 		}
 		http2Transport := &http2.Transport{
 			AllowHTTP:          true,
@@ -64,7 +75,25 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) {
 		b.Logger.Critical(&libpack_logger.LogMessage{
 			Message: "Invalid endpoint - neither http or https",
 		})
-		return nil
+		// Return error instead of nil to prevent nil pointer dereference
+		return nil, fmt.Errorf("invalid endpoint: %s - must start with http:// or https://", endpoint)
+	}
+	return http_client, nil
+}
+
+// getHTTPClientTLSConfig returns TLS configuration for HTTP client
+// By default, TLS verification is enabled for security.
+// Set GRAPHQL_INSECURE_SKIP_VERIFY=true to disable verification (NOT RECOMMENDED for production)
+func getHTTPClientTLSConfig() *tls.Config {
+	skipVerify := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") == "true"
+
+	if skipVerify {
+		// Log warning to stderr when running in insecure mode
+		fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification is disabled. This is insecure and should not be used in production.\n")
+	}
+
+	return &tls.Config{
+		InsecureSkipVerify: skipVerify,
+		MinVersion:         tls.VersionTLS12, // Enforce minimum TLS 1.2 for security
 	}
-	return http_client
 }

http_test.go

@@ -2,6 +2,7 @@ package gql
 
 import (
 	"net/http"
+	"os"
 	"testing"
 	"time"
 
@@ -13,7 +14,8 @@ func (suite *Tests) TestBaseClient_createHttpClient() {
 		client := NewConnection()
 		client.SetEndpoint("http://example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
 		assert.NotNil(httpClient)
 		assert.Equal(30*time.Second, httpClient.Timeout)
 		assert.NotNil(httpClient.Transport)
@@ -33,10 +35,22 @@ func (suite *Tests) TestBaseClient_createHttpClient() {
 	})
 
 	suite.T().Run("should create HTTP/2 client for https endpoints", func(t *testing.T) {
+		// Set environment variable for test to skip TLS verification
+		oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+		os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true")
+		t.Cleanup(func() {
+			if oldValue != "" {
+				os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue)
+			} else {
+				os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+			}
+		})
+
 		client := NewConnection()
 		client.SetEndpoint("https://example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
 		assert.NotNil(httpClient)
 		assert.Equal(30*time.Second, httpClient.Timeout)
 		assert.NotNil(httpClient.Transport)
@@ -56,7 +70,9 @@ func (suite *Tests) TestBaseClient_createHttpClient() {
 		client := NewConnection()
 		client.SetEndpoint("ftp://example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.Error(err)
+		assert.Contains(err.Error(), "invalid endpoint")
 		assert.Nil(httpClient)
 	})
 
@@ -64,21 +80,24 @@ func (suite *Tests) TestBaseClient_createHttpClient() {
 		client := NewConnection()
 		client.SetEndpoint("http://example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
 		assert.NotNil(httpClient)
 		assert.NotNil(httpClient.CheckRedirect)
 
 		// Test redirect policy
 		req, _ := http.NewRequest("GET", "http://example.com", nil)
-		err := httpClient.CheckRedirect(req, []*http.Request{})
-		assert.Equal(http.ErrUseLastResponse, err)
+		err2 := httpClient.CheckRedirect(req, []*http.Request{})
+		assert.Equal(http.ErrUseLastResponse, err2)
 	})
 
 	suite.T().Run("should handle empty endpoint", func(t *testing.T) {
 		client := NewConnection()
 		client.SetEndpoint("")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.Error(err)
+		assert.Contains(err.Error(), "invalid endpoint")
 		assert.Nil(httpClient)
 	})
 
@@ -86,9 +105,35 @@ func (suite *Tests) TestBaseClient_createHttpClient() {
 		client := NewConnection()
 		client.SetEndpoint("example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.Error(err)
+		assert.Contains(err.Error(), "invalid endpoint")
 		assert.Nil(httpClient)
 	})
+
+	suite.T().Run("should enable TLS verification by default for https endpoints", func(t *testing.T) {
+		// Ensure the environment variable is not set
+		oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+		os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+		t.Cleanup(func() {
+			if oldValue != "" {
+				os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue)
+			}
+		})
+
+		client := NewConnection()
+		client.SetEndpoint("https://example.com/graphql")
+
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
+		assert.NotNil(httpClient)
+
+		// Check that TLS verification is enabled by default
+		transport, ok := httpClient.Transport.(*http2.Transport)
+		assert.True(ok)
+		assert.NotNil(transport.TLSClientConfig)
+		assert.False(transport.TLSClientConfig.InsecureSkipVerify) // Should be false by default
+	})
 }
 
 func (suite *Tests) TestBaseClient_createHttpClient_transportSettings() {
@@ -96,7 +141,9 @@ func (suite *Tests) TestBaseClient_createHttpClient_transportSettings() {
 		client := NewConnection()
 		client.SetEndpoint("http://example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
+		assert.NotNil(httpClient)
 		transport := httpClient.Transport.(*http.Transport)
 
 		// Verify all transport settings
@@ -112,10 +159,23 @@ func (suite *Tests) TestBaseClient_createHttpClient_transportSettings() {
 	})
 
 	suite.T().Run("should configure HTTP/2 transport correctly", func(t *testing.T) {
+		// Set environment variable for test to skip TLS verification
+		oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+		os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true")
+		t.Cleanup(func() {
+			if oldValue != "" {
+				os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue)
+			} else {
+				os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+			}
+		})
+
 		client := NewConnection()
 		client.SetEndpoint("https://example.com/graphql")
 
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
+		assert.NotNil(httpClient)
 		transport := httpClient.Transport.(*http2.Transport)
 
 		// Verify all HTTP/2 transport settings
@@ -135,17 +195,30 @@ func (suite *Tests) TestBaseClient_createHttpClient_logging() {
 
 		// This test verifies that the function runs without error
 		// The actual logging is tested indirectly through the logger tests
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
 		assert.NotNil(httpClient)
 	})
 
 	suite.T().Run("should log HTTP/2 usage", func(t *testing.T) {
+		// Set environment variable for test to skip TLS verification
+		oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+		os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true")
+		t.Cleanup(func() {
+			if oldValue != "" {
+				os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue)
+			} else {
+				os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+			}
+		})
+
 		client := NewConnection()
 		client.SetEndpoint("https://example.com/graphql")
 
 		// This test verifies that the function runs without error
 		// The actual logging is tested indirectly through the logger tests
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.NoError(err)
 		assert.NotNil(httpClient)
 	})
 
@@ -155,7 +228,9 @@ func (suite *Tests) TestBaseClient_createHttpClient_logging() {
 
 		// This test verifies that the function runs without error
 		// and returns nil for invalid endpoints (Critical() won't exit in tests)
-		httpClient := client.createHttpClient()
+		httpClient, err := client.createHttpClient()
+		assert.Error(err)
+		assert.Contains(err.Error(), "invalid endpoint")
 		assert.Nil(httpClient)
 	})
 }

json_encoding_test.go

@@ -10,6 +10,7 @@ import (
 // TestQueryJSONEncoding verifies that the Query struct serializes correctly
 // without including the JsonQuery field, preventing "Trailing garbage" errors
 func TestQueryJSONEncoding(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 	client := CreateTestClient()
 
@@ -47,6 +48,7 @@ func TestQueryJSONEncoding(t *testing.T) {
 
 // TestQueryJSONEncodingPreventsTrailingGarbage ensures the fix prevents the specific error
 func TestQueryJSONEncodingPreventsTrailingGarbage(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 	client := CreateTestClient()
 

main.go

@@ -1,6 +1,7 @@
 package gql
 
 import (
+	"fmt"
 	"net/http"
 	"time"
 
@@ -40,7 +41,18 @@ func NewConnection() (b *BaseClient) {
 		retries_number: envutil.GetInt("GRAPHQL_RETRIES_NUMBER", 3),
 		minify_queries: envutil.GetBool("GRAPHQL_MINIFY_QUERIES", true), // Default: enabled for production efficiency
 	}
-	b.client = b.createHttpClient()
+	client, err := b.createHttpClient()
+	if err != nil {
+		b.Logger.Critical(&logging.LogMessage{
+			Message: "Failed to create HTTP client",
+			Pairs: map[string]interface{}{
+				"error": err.Error(),
+			},
+		})
+		// For backward compatibility, we'll still return the client but it won't work
+		return b
+	}
+	b.client = client
 	b.Logger.Debug(&logging.LogMessage{
 		Message: "Created new GraphQL client connection",
 		Pairs: map[string]interface{}{
@@ -51,21 +63,46 @@ func NewConnection() (b *BaseClient) {
 }
 
 func (b *BaseClient) SetEndpoint(endpoint string) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
 	b.endpoint = endpoint
 }
 
-func (b *BaseClient) SetOutput(responseType string) {
-	// allowed are byte, string, mapstring
-	// check if responseType is allowed
-	// TODO: implement
+func (b *BaseClient) SetOutput(responseType string) error {
+	// Validate responseType - allowed values are "byte", "string", "mapstring"
+	allowedTypes := map[string]bool{
+		"byte":      true,
+		"string":    true,
+		"mapstring": true,
+	}
+
+	if !allowedTypes[responseType] {
+		return fmt.Errorf("invalid response type: %s. Allowed values are: byte, string, mapstring", responseType)
+	}
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
 	b.responseType = responseType
+
+	b.Logger.Debug(&logging.LogMessage{
+		Message: "Response type updated",
+		Pairs: map[string]interface{}{
+			"response_type": responseType,
+		},
+	})
+
+	return nil
 }
 
 func (b *BaseClient) SetHTTPClient(client *http.Client) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
 	b.client = client
 }
 
 func (b *BaseClient) SetQueryMinification(enabled bool) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
 	b.minify_queries = enabled
 	b.Logger.Debug(&logging.LogMessage{
 		Message: "GraphQL query minification setting updated",

query.go

@@ -10,6 +10,13 @@ import (
 	libpack_logger "github.com/lukaszraczylo/go-simple-graphql/logging"
 )
 
+// Size limit constants for security
+const (
+	MaxQuerySize    = 100 * 1024       // 100KB max query size
+	MaxVariableSize = 10 * 1024        // 10KB max variables size
+	MaxResponseSize = 10 * 1024 * 1024 // 10MB max response size
+)
+
 // minifyGraphQLQuery removes unnecessary whitespace from GraphQL queries while preserving string literals
 func minifyGraphQLQuery(query string) string {
 	if query == "" {
@@ -238,7 +245,10 @@ func (b *BaseClient) compileQuery(queryPartials ...any) *Query {
 
 	// Apply query minification if enabled (default: true)
 	finalQuery := query
-	if b.minify_queries {
+	b.mu.RLock()
+	minifyEnabled := b.minify_queries
+	b.mu.RUnlock()
+	if minifyEnabled {
 		originalSize := len(query)
 		minifiedQuery := minifyGraphQLQuery(query)
 		minifiedSize := len(minifiedQuery)
@@ -268,9 +278,36 @@ func (b *BaseClient) compileQuery(queryPartials ...any) *Query {
 }
 
 func (b *BaseClient) Query(query string, variables map[string]interface{}, headers map[string]interface{}) (any, error) {
+	// Validate query size limit
+	if len(query) > MaxQuerySize {
+		b.Logger.Error(&libpack_logger.LogMessage{
+			Message: "Query exceeds maximum size limit",
+			Pairs: map[string]interface{}{
+				"query_size": len(query),
+				"max_size":   MaxQuerySize,
+			},
+		})
+		return nil, fmt.Errorf("query size %d exceeds maximum allowed size of %d bytes", len(query), MaxQuerySize)
+	}
+
 	// Process flags before compilation to avoid recompilation
 	enableCache, enableRetries, cleanedVariables := processFlags(variables, headers)
 
+	// Validate variables size limit
+	if cleanedVariables != nil {
+		variablesJSON, err := json.Marshal(cleanedVariables)
+		if err == nil && len(variablesJSON) > MaxVariableSize {
+			b.Logger.Error(&libpack_logger.LogMessage{
+				Message: "Variables exceed maximum size limit",
+				Pairs: map[string]interface{}{
+					"variables_size": len(variablesJSON),
+					"max_size":       MaxVariableSize,
+				},
+			})
+			return nil, fmt.Errorf("variables size %d exceeds maximum allowed size of %d bytes", len(variablesJSON), MaxVariableSize)
+		}
+	}
+
 	// Compile query once with cleaned variables
 	compiledQuery := b.compileQuery(query, cleanedVariables)
 	if compiledQuery == nil || compiledQuery.JsonQuery == nil {
@@ -282,11 +319,14 @@ func (b *BaseClient) Query(query string, variables map[string]interface{}, heade
 	}
 	b.Logger.Debug(&libpack_logger.LogMessage{
 		Message: "Compiled query",
-		Pairs:   map[string]interface{}{"query": compiledQuery},
+		Pairs:   map[string]interface{}{"query": sanitizeForLogging(compiledQuery.Query)},
 	})
 
 	var queryHash string
-	if (enableCache || b.cache_global) && strutil.HasPrefix(compiledQuery.Query, "query") {
+	b.mu.RLock()
+	cacheGlobal := b.cache_global
+	b.mu.RUnlock()
+	if (enableCache || cacheGlobal) && strutil.HasPrefix(compiledQuery.Query, "query") {
 		b.Logger.Debug(&libpack_logger.LogMessage{
 			Message: "Cache enabled",
 			Pairs:   nil,
@@ -295,13 +335,13 @@ func (b *BaseClient) Query(query string, variables map[string]interface{}, heade
 		if cachedValue := b.cacheLookup(queryHash); cachedValue != nil {
 			b.Logger.Debug(&libpack_logger.LogMessage{
 				Message: "Cache hit",
-				Pairs:   map[string]interface{}{"query": compiledQuery},
+				Pairs:   map[string]interface{}{"query_hash": queryHash},
 			})
 			return b.decodeResponse(cachedValue)
 		}
 		b.Logger.Debug(&libpack_logger.LogMessage{
 			Message: "Cache miss",
-			Pairs:   map[string]interface{}{"query": compiledQuery},
+			Pairs:   map[string]interface{}{"query_hash": queryHash},
 		})
 	}
 
@@ -315,7 +355,11 @@ func (b *BaseClient) Query(query string, variables map[string]interface{}, heade
 			}
 			return "no-cache"
 		}(),
-		Retries: enableRetries || b.retries_enable,
+		Retries: func() bool {
+			b.mu.RLock()
+			defer b.mu.RUnlock()
+			return enableRetries || b.retries_enable
+		}(),
 	}
 
 	rv, err := q.executeQuery()

query_minification_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestMinifyGraphQLQuery(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 
 	tests := []struct {
@@ -131,6 +132,7 @@ func TestMinifyGraphQLQuery(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
 			result := minifyGraphQLQuery(tt.input)
 			assert.Equal(tt.expected, result, "Minified query should match expected output")
 
@@ -150,6 +152,7 @@ func TestMinifyGraphQLQuery(t *testing.T) {
 }
 
 func TestMinifyGraphQLQuerySizeReduction(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 
 	// Test with a heavily formatted query
@@ -208,9 +211,11 @@ func TestMinifyGraphQLQuerySizeReduction(t *testing.T) {
 }
 
 func TestBaseClientQueryMinification(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 
 	t.Run("should_minify_queries_by_default", func(t *testing.T) {
+		t.Parallel()
 		client := CreateTestClient()
 
 		// Verify minification is enabled by default
@@ -233,6 +238,7 @@ func TestBaseClientQueryMinification(t *testing.T) {
 	})
 
 	t.Run("should_respect_minification_disabled", func(t *testing.T) {
+		t.Parallel()
 		client := CreateTestClient()
 		client.SetQueryMinification(false)
 
@@ -254,6 +260,7 @@ func TestBaseClientQueryMinification(t *testing.T) {
 	})
 
 	t.Run("should_handle_string_literals_correctly", func(t *testing.T) {
+		t.Parallel()
 		client := CreateTestClient()
 
 		query := `mutation test($value: String!) {
@@ -278,6 +285,7 @@ func TestBaseClientQueryMinification(t *testing.T) {
 	})
 
 	t.Run("should_demonstrate_size_reduction_with_production_case", func(t *testing.T) {
+		t.Parallel()
 		client := CreateTestClient()
 
 		// Use the production case from trailing garbage test
@@ -324,6 +332,7 @@ func TestBaseClientQueryMinification(t *testing.T) {
 }
 
 func TestIsAlphaNumeric(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 
 	tests := []struct {
@@ -351,6 +360,7 @@ func TestIsAlphaNumeric(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(string(tt.char), func(t *testing.T) {
+			t.Parallel()
 			result := isAlphaNumeric(tt.char)
 			assert.Equal(tt.expected, result, "isAlphaNumeric should correctly identify character type")
 		})
@@ -358,9 +368,11 @@ func TestIsAlphaNumeric(t *testing.T) {
 }
 
 func TestQueryMinificationEnvironmentVariable(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 
 	t.Run("should_respect_GRAPHQL_MINIFY_QUERIES_env_var", func(t *testing.T) {
+		t.Parallel()
 		// This test would require setting environment variables
 		// For now, we'll test the default behavior
 		client := NewConnection()
@@ -371,19 +383,23 @@ func TestQueryMinificationEnvironmentVariable(t *testing.T) {
 }
 
 func TestQueryMinificationEdgeCases(t *testing.T) {
+	t.Parallel()
 	assert := assertions.New(t)
 
 	t.Run("should_handle_empty_query", func(t *testing.T) {
+		t.Parallel()
 		result := minifyGraphQLQuery("")
 		assert.Equal("", result, "Empty query should remain empty")
 	})
 
 	t.Run("should_handle_query_with_only_whitespace", func(t *testing.T) {
+		t.Parallel()
 		result := minifyGraphQLQuery("   \n\t  \n  ")
 		assert.Equal("", result, "Query with only whitespace should become empty")
 	})
 
 	t.Run("should_handle_nested_quotes", func(t *testing.T) {
+		t.Parallel()
 		query := `mutation test {
 			insert_test(value: "String with \"nested quotes\" and 'mixed' quotes") {
 				id
@@ -395,6 +411,7 @@ func TestQueryMinificationEdgeCases(t *testing.T) {
 	})
 
 	t.Run("should_preserve_spaces_between_keywords", func(t *testing.T) {
+		t.Parallel()
 		query := `query test($var: String!) {
 			field(where: {id: {_eq: $var}}) {
 				id

request_compression_test.go

@@ -71,7 +71,8 @@ func (suite *RequestCompressionTestSuite) TestRequestCompression() {
 				client.endpoint = endpoint
 
 				// Create HTTP client using the same logic as the library
-				httpClient := client.createHttpClient()
+				httpClient, err := client.createHttpClient()
+				assert.NoError(err, "HTTP client should be created without error")
 				assert.NotNil(httpClient, "HTTP client should be created")
 
 				// Verify transport settings

sanitize.go

@@ -0,0 +1,63 @@
+package gql
+
+import (
+	"regexp"
+	"strings"
+)
+
+// Sensitive data patterns to redact from logs
+var (
+	// Pattern for common sensitive field names in JSON/GraphQL
+	sensitiveFieldPattern = regexp.MustCompile(`(?i)"?(password|passwd|pwd|token|apikey|api_key|api-key|secret|authorization|auth|bearer|credentials|private_key|private-key|access_token|refresh_token|client_secret|session|cookie)"?\s*:\s*"[^"]*"`)
+
+	// Pattern for authorization headers
+	authHeaderPattern = regexp.MustCompile(`(?i)(authorization|x-api-key|x-auth-token|bearer)\s*:\s*[^\s,}]+`)
+
+	// Pattern for basic auth in URLs
+	basicAuthURLPattern = regexp.MustCompile(`(https?://)([^:]+):([^@]+)@`)
+
+	// Pattern for JWT tokens
+	jwtPattern = regexp.MustCompile(`eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+`)
+)
+
+const redactedText = "[REDACTED]"
+
+// sanitizeForLogging removes sensitive data from strings before logging
+// This includes passwords, tokens, API keys, authorization headers, etc.
+func sanitizeForLogging(input string) string {
+	if input == "" {
+		return input
+	}
+
+	// Create a working copy
+	sanitized := input
+
+	// Redact sensitive fields in JSON/GraphQL
+	sanitized = sensitiveFieldPattern.ReplaceAllStringFunc(sanitized, func(match string) string {
+		// Preserve the field name but redact the value
+		parts := strings.SplitN(match, ":", 2)
+		if len(parts) == 2 {
+			fieldName := parts[0]
+			return fieldName + `: "` + redactedText + `"`
+		}
+		return redactedText
+	})
+
+	// Redact authorization headers
+	sanitized = authHeaderPattern.ReplaceAllStringFunc(sanitized, func(match string) string {
+		parts := strings.SplitN(match, ":", 2)
+		if len(parts) == 2 {
+			headerName := parts[0]
+			return headerName + ": " + redactedText
+		}
+		return redactedText
+	})
+
+	// Redact basic auth in URLs
+	sanitized = basicAuthURLPattern.ReplaceAllString(sanitized, "${1}"+redactedText+":"+redactedText+"@")
+
+	// Redact JWT tokens
+	sanitized = jwtPattern.ReplaceAllString(sanitized, redactedText)
+
+	return sanitized
+}

structs.go

@@ -2,6 +2,7 @@ package gql
 
 import (
 	"net/http"
+	"sync"
 	"time"
 
 	cache "github.com/lukaszraczylo/go-simple-graphql/cache"
@@ -9,6 +10,7 @@ import (
 )
 
 type BaseClient struct {
+	mu             sync.RWMutex // Protects all fields for thread-safe access
 	cache          *cache.Cache
 	Logger         *logging.Logger
 	client         *http.Client

suite_test.go

@@ -2,6 +2,7 @@ package gql
 
 import (
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	assertions "github.com/stretchr/testify/assert"
@@ -13,11 +14,19 @@ type Tests struct {
 }
 
 var (
-	assert     *assertions.Assertions
-	mockServer *httptest.Server
+	assert                    *assertions.Assertions
+	mockServer                *httptest.Server
+	originalInsecureSkipValue string
 )
 
 func (suite *Tests) SetupSuite() {
+	// Save original environment variable value
+	originalInsecureSkipValue = os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+
+	// Set environment variable to skip TLS verification for test mock server
+	// The mock server uses self-signed certificates
+	os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true")
+
 	// Start mock GraphQL server
 	mockServer = StartMockServer()
 }
@@ -30,6 +39,13 @@ func (suite *Tests) TearDownSuite() {
 
 	// Cleanup shared test cache
 	CleanupTestCache()
+
+	// Restore original environment variable value
+	if originalInsecureSkipValue != "" {
+		os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", originalInsecureSkipValue)
+	} else {
+		os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY")
+	}
 }
 
 func (suite *Tests) SetupTest() {