4 ms·

GET is only idempotent in theory. Way too many people abuse GET when creating websites.

by d33 9y ago

eesmith 9y ago
As an example of the problem, see the "Issues and criticism" of the related topic "Link prefetching" in Wikipedia - https://en.wikipedia.org/wiki/Link_prefetching#Issues_and_criticisms https://en.wikipedia.org/wiki/Link_prefetching#Issues_and_cr... .
- icebraining 9y ago
  Almost all of those problems only apply to in-browser prefetchers, which reuse the user's session and connection.
  - eesmith 9y ago
    Point taken. Thanks for the correction.
mosselman 9y ago
I believe that is the point that @K0nserv is making. The 'abuse' part I mean.
VMG 9y ago
Those people should suffer the consequences. I'm not a fan of facebook in the slightest, but they are crawling websites they were essentially invited to.
- CapacitorSet 9y ago
  >websites they were essentially invited to Using an analytics pixel is _not_ an invitation to crawl a website.
  - eli 9y ago
    No, merely posting it on a public server was the invitation
    - thecatspaw 9y ago
      It is not. Leaving your door unlocked is not inviting everybody in to take your stuff. You might make it easier for them to break in, but it still is a break in. Making something available to the public is not the same as going to the google webmaster tools and telling them to index your page.
      - eli 9y ago
        Someone viewing a webpage you put online is not at all like someone stealing something you own.
      - freehunter 9y ago
        You can argue it's abuse or illegal or fraud or whatever you want, but here's the thing: how are you going to stop them? Sure, maybe you stop Facebook with a lawsuit... but everyone else is still doing it, even people outside of your legal jurisdiction. They're still going to do it, so it's up to you to stop them with your design. If someone breaks into your website and destroys a user's data or steals their credit card, that user is not going to want to hear "but what they did was against our ToS!" This isn't your house where there are police patrolling and ready to respond at a moment's notice when they're called. This is the Internet, accessible by almost literally everyone on the planet, and they don't give a shit about your policy. That's why best practices and application security was invented. So use it.
      - Piskvorrr 9y ago
        "Hello, I am a HTTP client, can I have /some/super/secret/page?" "200 OK, here it is" That's your server complying with the request. Whether by intent or by oversight, doesn't matter: the client comes and asks, and your server can refuse. If it complies, well, you told it to. Whether you have merely exposed the page to the public or also shouted its URL from the rooftops, that's completely irrelevant. If it's not supposed to be public, don't make it public. "Hello, I am a HTTP client, can I have /some/super/secret/page?" "Oh, but you are ^User-agent$=.acebook ? Nope, 403 Forbidden, no data for you." (Or, more generally, "And who are you? 401 Authorize!" - or any other sort of mandatory access control)

GET is only idempotent in theory. Way too many people abuse GET when creating websites.

by d33 9y ago

GET is only idempotent in theory. Way too many people abuse GET when creating websites.

As an example of the problem, see the "Issues and criticism" of the related topic "Link prefetching" in Wikipedia - https://en.wikipedia.org/wiki/Link_prefetching#Issues_and_criticisms https://en.wikipedia.org/wiki/Link_prefetching#Issues_and_cr... .

icebraining 9y ago
Almost all of those problems only apply to in-browser prefetchers, which reuse the user's session and connection.
- eesmith 9y ago
  Point taken. Thanks for the correction.

mosselman 9y ago

I believe that is the point that @K0nserv is making. The 'abuse' part I mean.

VMG 9y ago

Those people should suffer the consequences. I'm not a fan of facebook in the slightest, but they are crawling websites they were essentially invited to.

CapacitorSet 9y ago
>websites they were essentially invited to Using an analytics pixel is _not_ an invitation to crawl a website.
- eli 9y ago
  No, merely posting it on a public server was the invitation
  - thecatspaw 9y ago
    It is not. Leaving your door unlocked is not inviting everybody in to take your stuff. You might make it easier for them to break in, but it still is a break in. Making something available to the public is not the same as going to the google webmaster tools and telling them to index your page.
    - eli 9y ago
      Someone viewing a webpage you put online is not at all like someone stealing something you own.
    - freehunter 9y ago
      You can argue it's abuse or illegal or fraud or whatever you want, but here's the thing: how are you going to stop them? Sure, maybe you stop Facebook with a lawsuit... but everyone else is still doing it, even people outside of your legal jurisdiction. They're still going to do it, so it's up to you to stop them with your design. If someone breaks into your website and destroys a user's data or steals their credit card, that user is not going to want to hear "but what they did was against our ToS!" This isn't your house where there are police patrolling and ready to respond at a moment's notice when they're called. This is the Internet, accessible by almost literally everyone on the planet, and they don't give a shit about your policy. That's why best practices and application security was invented. So use it.
    - Piskvorrr 9y ago
      "Hello, I am a HTTP client, can I have /some/super/secret/page?" "200 OK, here it is" That's your server complying with the request. Whether by intent or by oversight, doesn't matter: the client comes and asks, and your server can refuse. If it complies, well, you told it to. Whether you have merely exposed the page to the public or also shouted its URL from the rooftops, that's completely irrelevant. If it's not supposed to be public, don't make it public. "Hello, I am a HTTP client, can I have /some/super/secret/page?" "Oh, but you are ^User-agent$=.acebook ? Nope, 403 Forbidden, no data for you." (Or, more generally, "And who are you? 401 Authorize!" - or any other sort of mandatory access control)