4 ms·

Haha, blame the client for copying and pasting between pages, that sounds fair. This is also a pretty good case study of why using authentication frameworks is

by JonoW 15y ago

Haha, blame the client for copying and pasting between pages, that sounds fair. This is also a pretty good case study of why using authentication frameworks is a very good idea.

pavel_lishin 15y ago
Also why a GET request should never delete, or possibly even modify, data.
- JonoW 15y ago
  For sure. Combine the 2 mistakes and you're pretty fucked
- landhar 15y ago
  Indeed, although it isn't enough anymore: https://news.ycombinator.com/item?id=3100239 https://news.ycombinator.com/item?id=3100239
- deleted 15y ago
  [deleted]
  - pavel_lishin 15y ago
    > That would stop half the web working. What do you mean?
    - loup-vaillant 15y ago
      Probably that half the web rely on GET requests to do things they are totally not intended to do, like, deleting a resource. Therefore, if you suddenly find a way to actually forbid GET to ever trigger that, then that half wouldn't work "properly" any more.
  - JonnieCache 15y ago
    >Why should a GET never modify data? Because that's what the HTTP spec says. Wander off-spec, and you will eventually have problems, like the unfortunate gov department in the article. http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Saf... Relatedly, idempotency is a too-poorly understood concept.
  - deleted 15y ago
    [deleted]
    - deleted 15y ago
      [deleted]
  - deleted 15y ago
    [deleted]
  - deleted 15y ago
    [deleted]
  - masklinn 15y ago
    > Why should a GET never modify data? That would stop half the web working. Uh... no it would not, HTTP itself works under the assumption that GET is both safe and idempotent. It might break your sites because you're a terrible, terrible developer, and it will break some (it already has, in fact, look for "Google Accelerator" back in 2005, I think Firefox also did that at one point) but that won't be even close to half the web. And frankly, I see it as culling the herd, if you're building sites performing non-safe operations on GET you're a terrible person.
- deleted 15y ago
  [deleted]
  - deleted 15y ago
    [deleted]
- deleted 15y ago
  [deleted]

by JonoW 15y ago

Haha, blame the client for copying and pasting between pages, that sounds fair. This is also a pretty good case study of why using authentication frameworks is a very good idea.

pavel_lishin 15y ago

Also why a GET request should never delete, or possibly even modify, data.

JonoW 15y ago
For sure. Combine the 2 mistakes and you're pretty fucked
landhar 15y ago
Indeed, although it isn't enough anymore: https://news.ycombinator.com/item?id=3100239 https://news.ycombinator.com/item?id=3100239
deleted 15y ago
[deleted]
- pavel_lishin 15y ago
  > That would stop half the web working. What do you mean?
  - loup-vaillant 15y ago
    Probably that half the web rely on GET requests to do things they are totally not intended to do, like, deleting a resource. Therefore, if you suddenly find a way to actually forbid GET to ever trigger that, then that half wouldn't work "properly" any more.
- JonnieCache 15y ago
  >Why should a GET never modify data? Because that's what the HTTP spec says. Wander off-spec, and you will eventually have problems, like the unfortunate gov department in the article. http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Saf... Relatedly, idempotency is a too-poorly understood concept.
- deleted 15y ago
  [deleted]
  - deleted 15y ago
    [deleted]
- deleted 15y ago
  [deleted]
- deleted 15y ago
  [deleted]
- masklinn 15y ago
  > Why should a GET never modify data? That would stop half the web working. Uh... no it would not, HTTP itself works under the assumption that GET is both safe and idempotent. It might break your sites because you're a terrible, terrible developer, and it will break some (it already has, in fact, look for "Google Accelerator" back in 2005, I think Firefox also did that at one point) but that won't be even close to half the web. And frankly, I see it as culling the herd, if you're building sites performing non-safe operations on GET you're a terrible person.
deleted 15y ago
[deleted]
- deleted 15y ago
  [deleted]
deleted 15y ago
[deleted]