5 ms·
HTTP GET requests are supposed to be idempotent, meaning that when you call an URL twice it should not lead to any different result compared to calling it once.
by hannob 4y ago
HTTP GET requests are supposed to be idempotent, meaning that when you call an URL twice it should not lead to any different result compared to calling it once. This is part of the HTTP standard.
So while I think what Outlook does here is wrong, what these webpages do is simply a bug that should be fixed and shows a lack of understanding of HTTP.
- capableweb 4y ago> shows a lack of understanding of HTTP I think that's a bit too much. Nothing in that suggests that they are breaking anything in the HTTP specification. You're right that GET requests has to be idempotent, but the exchange from the single-time use code you get in email with the API token, is most likely behind a non-GET request (like POST). The HTTP server responds to GET requests with the static assets (HTML/CSS/JS), but then the static assets has JavaScript that calls the POST endpoint for the exchange. At least that's my guess. I agree it's a bug on their side, and they should fix it. But I think it's more of a UX issue than breaking the protocol.
- zbuf 4y agoAgree, the commentor is hung up on their demonstrably superior understanding of HTTP. We found at least one scanning service to be fetching the URL with the user agent of a browser, and executing JavaScript on the page. A lot of our user interactions could be simpler, but this sort of behaviour led to many things being put behind a "go" button. I only wonder how long before scanners and search engines start clicking these buttons to activate content on the page so they can scan/index it.
- aaaaaaaaaaab 4y agoIt's idempotent. Your account won't get un-verified if you open the verification link twice. Idempotent != side-effect free
- capableweb 4y agoIt's not though. Loading the page twice creates two different outcomes. Idempotent endpoints can't. !Idempotent != Reversal of changes
- aaaaaaaaaaab 4y agoWhat are the two different outcomes? 1. You open the link once = your account is verified 2. You open the link twice = your account is still verified ???
- adamckay 4y agoIf it's a magic link for logging in: 1. You open the link once = you're logged in 2. You open the link twice = you're presented with an error that the magic link has already been used.
- dragonwriter 4y agoGET is supposed to be safe as well as idempotent though. Request methods are considered "safe" if their defined semantics are essentially read-only; i.e., the client does not request, and does not expect, any state change on the origin server as a result of applying a safe method to a target resource. (RFC 7231, § 4.2.1)
- okamiueru 4y agoI wouldn't go around saying others don't understand http. Puts you in a very awkward position when you are wrong. Which, you are. Idempotency and safety are separate concepts related to http. But, you do you. Take the advice however you want.