4 ms·
From RFC 2616 (Fielding et al) at http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html "In particular, t
by jschulenklopper 13y ago
From RFC 2616 (Fielding et al) at http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
"In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested."
The document section also makes a distinction between "safe" and "idempotent" methods. That's not the same thing.
- iguana 13y agoLots of web apps are still implemented along the lines of: GET /foo?action=delete&item=x A less naive implementation would also include a crumb to mitigate CSRF as well as unintentional access.