3 ms·

So why is there no problem with vote/flag/vouche on HN being GET endpoints?

by TekMol 1y ago

buzzy_hacker 1y ago
https://news.ycombinator.com/item?id=3742902 https://news.ycombinator.com/item?id=3742902
- bmacho 1y ago
  Indeed, user embedded pictures can fire GET requests while can not make POST requests. But this is not a problem if you don't allow users to embed pictures, or you authenticate the GET request somehow. Anyway GET requests are just fine.
- TekMol 1y ago
  The same would have worked with a POST endpoint. The story url only would have to point to a web page that creates the upvote post request via JS.
  - Scarblac 1y ago
    That runs into CORS protections though. CORS is a lot less strict around GET as it is supposed to be safe.
    - TekMol 1y ago
      Nope, it would not have been prevented by CORS. CORS prevents reading from a resource, not from sending the request. If you find that surprising, think about that the JS could also have for example created a form with the vote page as the target and clicked on the submit button. All completely unrelated to CORS.
      - JimDabell 1y ago
        > CORS prevents reading from a resource CORS does nothing of the sort. It does the exact opposite – it’s explicitly designed to allow reading a resource, where the SOP would ordinarily deny it.
        bmacho 1y ago
        Even mdn calls it "violating the CORS security rules" instead of SOP rules: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR... Anyway, this is lame low effort trolling for some unknown purpose. Stop it.
deleted 1y ago
[deleted]
Scarblac 1y ago
There is, it's bad. Luckily votes aren't very crucial.
- TekMol 1y ago
  Votes are crucial. HN goes to great lengths to prevent votes that do not stem from real user intent. See this post for example: https://news.ycombinator.com/item?id=22761897 https://news.ycombinator.com/item?id=22761897 Quotes: "Voting ring detection has been one of HN's priorities for over 12 years" "I've personally spent hundreds of hours working on this"
Balooga 1y ago
Then that does not conform to the HTTP spec. GET endpoints must be safe, idempotent, cachable. Opening up a site to cases were web crawlers/scrapers may wreak havoc.

So why is there no problem with vote/flag/vouche on HN being GET endpoints?

by TekMol 1y ago

So why is there no problem with vote/flag/vouche on HN being GET endpoints?

buzzy_hacker 1y ago

https://news.ycombinator.com/item?id=3742902 https://news.ycombinator.com/item?id=3742902

bmacho 1y ago
Indeed, user embedded pictures can fire GET requests while can not make POST requests. But this is not a problem if you don't allow users to embed pictures, or you authenticate the GET request somehow. Anyway GET requests are just fine.
TekMol 1y ago
The same would have worked with a POST endpoint. The story url only would have to point to a web page that creates the upvote post request via JS.
- Scarblac 1y ago
  That runs into CORS protections though. CORS is a lot less strict around GET as it is supposed to be safe.
  - TekMol 1y ago
    Nope, it would not have been prevented by CORS. CORS prevents reading from a resource, not from sending the request. If you find that surprising, think about that the JS could also have for example created a form with the vote page as the target and clicked on the submit button. All completely unrelated to CORS.
    - JimDabell 1y ago
      > CORS prevents reading from a resource CORS does nothing of the sort. It does the exact opposite – it’s explicitly designed to allow reading a resource, where the SOP would ordinarily deny it.
      - bmacho 1y ago
        Even mdn calls it "violating the CORS security rules" instead of SOP rules: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR... Anyway, this is lame low effort trolling for some unknown purpose. Stop it.

deleted 1y ago

[deleted]

Scarblac 1y ago

There is, it's bad. Luckily votes aren't very crucial.

TekMol 1y ago
Votes are crucial. HN goes to great lengths to prevent votes that do not stem from real user intent. See this post for example: https://news.ycombinator.com/item?id=22761897 https://news.ycombinator.com/item?id=22761897 Quotes: "Voting ring detection has been one of HN's priorities for over 12 years" "I've personally spent hundreds of hours working on this"

Balooga 1y ago

Then that does not conform to the HTTP spec. GET endpoints must be safe, idempotent, cachable. Opening up a site to cases were web crawlers/scrapers may wreak havoc.