4 ms·
I didn't realize this was part of a standard. Could you link to the section you're referring to?
by andreyf 13y ago
I didn't realize this was part of a standard. Could you link to the section you're referring to?
- Groxx 13y agoright up near the top: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
- adolph 13y agohttp://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request. The methods GET, HEAD, PUT and DELETE share this property.
- jschulenklopper 13y agoFrom RFC 2616 (Fielding et al) at http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html "In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested." The document section also makes a distinction between "safe" and "idempotent" methods. That's not the same thing.
- iguana 13y agoLots of web apps are still implemented along the lines of: GET /foo?action=delete&item=x A less naive implementation would also include a crumb to mitigate CSRF as well as unintentional access.