4 ms·

Elastic search (used to?) use HTTP body as parameters for a GET request. IIRC the HTTP specification doesn't (again, used to?) mandate GET request to have no HT

by a_c 4y ago

Elastic search (used to?) use HTTP body as parameters for a GET request. IIRC the HTTP specification doesn't (again, used to?) mandate GET request to have no HTTP body Edit: Example of Elastic search API with GET body, now deprecated https://www.elastic.co/guide/en/elasticsearch/reference/7.7/search-request-body.html https://www.elastic.co/guide/en/elasticsearch/reference/7.7/... Edit 2: https://stackoverflow.com/questions/978061/http-get-with-request-body https://stackoverflow.com/questions/978061/http-get-with-req... The now obsolete specification https://www.rfc-editor.org/rfc/rfc2616 https://www.rfc-editor.org/rfc/rfc2616 , obsoleted by https://www.rfc-editor.org/rfc/rfc9110 https://www.rfc-editor.org/rfc/rfc9110

jillesvangurp 4y ago
It still does. I don't think it violates the HTTP 1.1 specification but more that it is unspecified. It's just that a lot of http clients simply don't support doing HTTP GET with a body under the assumption that it is redundant / not needed / forbidden. Of course elasticsearch allows POST as an alternative. People used to obsess a lot more about those HTTP verbs and their meaning a lot more than today. At least I don't seem to get dragged into debates on the virtues of PUT vs. POST, or using PATCH for a simple update API. If you use graphql, everything is a POST anyway. Much like SOAP back in the day. It's all just different ways to call stuff on servers. Remote procedure calls have a long history that predates all of the web.
- pixl97 4y ago
  I feel not obsessing about the meanings of HTTP verbs can, has, and will lead to security incidents and interoperability issues between middleware. Specifications where everyone gets to pick and choose different behaviors is a nightmare.
  - int_19h 4y ago
    The obsession with fine-grained distinctions may be gone, but GET/POST is still relevant when talking about caching etc.
- chrisweekly 4y ago
  GET requests with a body (unspecified in HTTP/1.1) reminds me of a similar case I encountered years ago: URL query params in a POST (an HTML form whose action attr contained a query string).
  - hackerman123469 4y ago
    It's fairly common to have POST requests that have both a body and a query string. Or maybe not "fairly common" but it isn't really rare.
    - chrisweekly 4y ago
      I know it's not that rare. But it is problematic.

by a_c 4y ago

jillesvangurp 4y ago

It still does. I don't think it violates the HTTP 1.1 specification but more that it is unspecified. It's just that a lot of http clients simply don't support doing HTTP GET with a body under the assumption that it is redundant / not needed / forbidden. Of course elasticsearch allows POST as an alternative. People used to obsess a lot more about those HTTP verbs and their meaning a lot more than today. At least I don't seem to get dragged into debates on the virtues of PUT vs. POST, or using PATCH for a simple update API. If you use graphql, everything is a POST anyway. Much like SOAP back in the day. It's all just different ways to call stuff on servers. Remote procedure calls have a long history that predates all of the web.

pixl97 4y ago
I feel not obsessing about the meanings of HTTP verbs can, has, and will lead to security incidents and interoperability issues between middleware. Specifications where everyone gets to pick and choose different behaviors is a nightmare.
- int_19h 4y ago
  The obsession with fine-grained distinctions may be gone, but GET/POST is still relevant when talking about caching etc.
chrisweekly 4y ago
GET requests with a body (unspecified in HTTP/1.1) reminds me of a similar case I encountered years ago: URL query params in a POST (an HTML form whose action attr contained a query string).
- hackerman123469 4y ago
  It's fairly common to have POST requests that have both a body and a query string. Or maybe not "fairly common" but it isn't really rare.
  - chrisweekly 4y ago
    I know it's not that rare. But it is problematic.