3 ms·
Yes, but the GET itself isn't changing any state. The state changes only after clicking on the button. This is OP's point.
by GTP 2y ago
Yes, but the GET itself isn't changing any state. The state changes only after clicking on the button. This is OP's point.
- kragen 2y agoTeMPOraL said, "magic links by definition violate the principle that GET requests should not change state". That is a reasonable thing to think, but it is not true, because you can GET a <form> which POSTs when you click the "log in" button, unless you think a link to such a <form> page should be excluded from the definition of "magic link".
- Jolter 2y agoIn your example, it seems to me that the POST request is the action that changes the state.
- kragen 2y agoAgreed.
- TeMPOraL 2y ago> unless you think a link to such a <form> page should be excluded from the definition of "magic link". Yes. Linking to a form requiring user to press a button to submit an actual POST request is one proper way of doing it, and won't confuse prefetchers, previewers and security scanners - but it lacks the specific "magic" in question, which is that clicking on a link alone is enough to log you in. Can't really have both - the "magic" is really just violating the "GET doesn't mutate" rule, rebranding the mistake we already corrected 20+ years ago. (EDIT: Also the whole framing of "magic links" vs. passkeys reads to me like telling people that committing sins is the wrong way of getting to hell, because you can just ask the devil directly instead.)
- kragen 2y agoAha, then we agree on the facts, just disagree about nomenclature. Your theological analogy is hilarious!