5 ms·

Well per the HTTP standard, GET requests should be idempotent. I kid, but imagine seeing pompous development advice stapled to official justification for some i

Well per the HTTP standard, GET requests should be idempotent. I kid, but imagine seeing pompous development advice stapled to official justification for some internet sleuthing!

andreyf 13y ago
I didn't realize this was part of a standard. Could you link to the section you're referring to?
- Groxx 13y ago
  right up near the top: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
- adolph 13y ago
  http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request. The methods GET, HEAD, PUT and DELETE share this property.
- jschulenklopper 13y ago
  From RFC 2616 (Fielding et al) at http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html "In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested." The document section also makes a distinction between "safe" and "idempotent" methods. That's not the same thing.
  - iguana 13y ago
    Lots of web apps are still implemented along the lines of: GET /foo?action=delete&item=x A less naive implementation would also include a crumb to mitigate CSRF as well as unintentional access.
    - vidarh 13y ago
      Yes, and you regularly see notes about how [some bot] has caused some developer to learn why this is bad practice whenever a link like that gets accidentally exposed in a way that allows crawling.
    - wolf550e 13y ago
      popular web browsers prefetch links.
eyeface 13y ago
Do you mean that GET requests shouldn't modify data? A URL that deletes everything would be idempotent; if it's hit once, it's the same effect as if it's hit many times.
- oinksoft 13y ago
  Yes. Idempotency is just one property of the GET request, what parent described would be a DELETE request (these too are idempotent). So I could have been more precise and funny with that joke, I guess.
gleenn 13y ago
If you RTFA, it looks like it isn't even doing a GET, its doing a HEAD request.
- mschuster91 13y ago
  So what, many PHP apps don't check for the HTTP type, and even less Perl/other CGI scripts. Never rely on your environment to differ between the various HTTP methods for you.

Well per the HTTP standard, GET requests should be idempotent. I kid, but imagine seeing pompous development advice stapled to official justification for some internet sleuthing!

andreyf 13y ago

I didn't realize this was part of a standard. Could you link to the section you're referring to?

Groxx 13y ago
right up near the top: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
adolph 13y ago
http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request. The methods GET, HEAD, PUT and DELETE share this property.
jschulenklopper 13y ago
From RFC 2616 (Fielding et al) at http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html "In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested." The document section also makes a distinction between "safe" and "idempotent" methods. That's not the same thing.
- iguana 13y ago
  Lots of web apps are still implemented along the lines of: GET /foo?action=delete&item=x A less naive implementation would also include a crumb to mitigate CSRF as well as unintentional access.
  - vidarh 13y ago
    Yes, and you regularly see notes about how [some bot] has caused some developer to learn why this is bad practice whenever a link like that gets accidentally exposed in a way that allows crawling.
  - wolf550e 13y ago
    popular web browsers prefetch links.

eyeface 13y ago

Do you mean that GET requests shouldn't modify data? A URL that deletes everything would be idempotent; if it's hit once, it's the same effect as if it's hit many times.

oinksoft 13y ago
Yes. Idempotency is just one property of the GET request, what parent described would be a DELETE request (these too are idempotent). So I could have been more precise and funny with that joke, I guess.

gleenn 13y ago

If you RTFA, it looks like it isn't even doing a GET, its doing a HEAD request.

mschuster91 13y ago
So what, many PHP apps don't check for the HTTP type, and even less Perl/other CGI scripts. Never rely on your environment to differ between the various HTTP methods for you.