3 ms·

Instagram uses POST method do actually issue a "delete" photo request on their API. Just wanted to say this is a bad REST API practice. http://reventlov.com/ad

• gfosco 14y ago
  Bad is such a subjective word... Nothing bad about using typical HTTP get/post to run your app. Things don't have to conform to REST. Using PUT/DELETE won't make it any more secure.
• terhechte 14y ago
  Their official API handles REST correctly (i.e. utilizing PUT and POST and DELETE where necessary) however, deleting images is not part of the official API, it is only available for the iPhone / Android apps. So I guess they just never came round to changing this since it is only part of an internal protocol anyway.
• travisp 14y ago
  This surely has nothing to do with the security problem, even if it's not exactly REST. It's not even that unusual for browser focused APIs: For example, many older browsers don't support sending the DELETE method, so Ruby on Rails applications often send Ajax DELETE requests as a POST, with the "_method" parameter set to "delete" (rather than a different URL as in the case of Instagram). That's probably not the reason in Instagram's case, but if you look at a lot of public REST APIs you are going to find many things that aren't exactly "REST".