3 ms·

Not sure I agree with this part: > Allow all GET, HEAD, or OPTIONS requests. > These are safe methods, and are assumed not to change state at various layers o

Not sure I agree with this part: > Allow all GET, HEAD, or OPTIONS requests. > These are safe methods, and are assumed not to change state at various layers of the stack already. Plenty of apps violate this assumption and do allow GET requests to alter state.

chrisfosterelli 1y ago
IMO apps that do this have a bug, and possibly a security one. This causes issues with prefetching, bot traffic, caching, CSRF, and just plain violates HTTP standards.
- pstuart 1y ago
  Agreed. Those methods should be treated as idempotent.
  - almog 1y ago
    > Those methods should be treated as idempotent Idempotency still implies it can change state on the initial call, which to me feels wrong in the context of GET/HEAD/OPTIONS.
    - Mavvie 1y ago
      Indeed, the correct term here is nullipotent.
- pinoy420 1y ago
  Not really. If I have a service where I need one click to perform an action and store data. It has to be a GET. You can’t post from a url… purist dogma for the sake of purist dogma
  - FireInsight 1y ago
    One click to perform an action and store data? Have you heard of HTML forms with method="post"?
    - whatabtemaillnk 1y ago
      [dead]
simonw 1y ago
Those apps are beyond helping already. They need to fix theselves.
nchmy 1y ago
The entire WordPress ecosystem says hello
cryptonector 1y ago
This is on the server side, on the app. If your supposedly-safe methods aren't safe, then CSRF may not be your biggest problem.
paulhodge 1y ago
That’s bad because visiting an evil site can easily trick your browser into performing one of those requests using your own credentials. CORS doesn’t stop the backend state effect from happening.
- MajesticHobo2 1y ago
  That's exactly why I don't agree that GETs should be broadly exempted from CSRF protections. I'm not talking about CORS at all.
motorest 1y ago
> Plenty of apps violate this assumption and do allow GET requests to alter state. Yeah, that's not a justification. From a RESTful API design perspective, this just means plenty of apps are buggy/critical design problems. A bug in a random app does not mean HTTP verb lose their semantics.

chrisfosterelli 1y ago

IMO apps that do this have a bug, and possibly a security one. This causes issues with prefetching, bot traffic, caching, CSRF, and just plain violates HTTP standards.

pstuart 1y ago
Agreed. Those methods should be treated as idempotent.
- almog 1y ago
  > Those methods should be treated as idempotent Idempotency still implies it can change state on the initial call, which to me feels wrong in the context of GET/HEAD/OPTIONS.
  - Mavvie 1y ago
    Indeed, the correct term here is nullipotent.
pinoy420 1y ago
Not really. If I have a service where I need one click to perform an action and store data. It has to be a GET. You can’t post from a url… purist dogma for the sake of purist dogma
- FireInsight 1y ago
  One click to perform an action and store data? Have you heard of HTML forms with method="post"?
  - whatabtemaillnk 1y ago
    [dead]

simonw 1y ago

Those apps are beyond helping already. They need to fix theselves.

nchmy 1y ago

The entire WordPress ecosystem says hello

cryptonector 1y ago

This is on the server side, on the app. If your supposedly-safe methods aren't safe, then CSRF may not be your biggest problem.

paulhodge 1y ago

That’s bad because visiting an evil site can easily trick your browser into performing one of those requests using your own credentials. CORS doesn’t stop the backend state effect from happening.

MajesticHobo2 1y ago
That's exactly why I don't agree that GETs should be broadly exempted from CSRF protections. I'm not talking about CORS at all.

motorest 1y ago

> Plenty of apps violate this assumption and do allow GET requests to alter state. Yeah, that's not a justification. From a RESTful API design perspective, this just means plenty of apps are buggy/critical design problems. A bug in a random app does not mean HTTP verb lose their semantics.