3 ms·

> shows a lack of understanding of HTTP I think that's a bit too much. Nothing in that suggests that they are breaking anything in the HTTP specification. You'

> shows a lack of understanding of HTTP I think that's a bit too much. Nothing in that suggests that they are breaking anything in the HTTP specification. You're right that GET requests has to be idempotent, but the exchange from the single-time use code you get in email with the API token, is most likely behind a non-GET request (like POST). The HTTP server responds to GET requests with the static assets (HTML/CSS/JS), but then the static assets has JavaScript that calls the POST endpoint for the exchange. At least that's my guess. I agree it's a bug on their side, and they should fix it. But I think it's more of a UX issue than breaking the protocol.

zbuf 4y ago
Agree, the commentor is hung up on their demonstrably superior understanding of HTTP. We found at least one scanning service to be fetching the URL with the user agent of a browser, and executing JavaScript on the page. A lot of our user interactions could be simpler, but this sort of behaviour led to many things being put behind a "go" button. I only wonder how long before scanners and search engines start clicking these buttons to activate content on the page so they can scan/index it.