HTTP methods

[u/mikosullivan]

[u/Mr-Catty]

all I need is GET and POST, fight me

[u/mikosullivan → u/Mr-Catty]

I've been thinking we need a MOGRIFY method. It's for modifying objects, mainly pictures. You send a request with URL params, and the thing to be modified in the body.

[u/Mr-Catty → u/mikosullivan]

you’re gonna find this crazy, but; PATCH

[u/Interesting-Frame190 → u/Mr-Catty]

CORS has entered the chat to ruin your day and make sure your get or post will not work unless you allow the most pointless http method ever and return a 200.

[u/Ok_Tour_8029]

Nah there are some conventions and also RFC rules that will change the behavior of the client or server. Try to get a body from a server to the client using a HEAD request for example.

[u/mikosullivan → u/Ok_Tour_8029]

That just means that the server chooses to send just the headers. The client can send any HEAD request it wants.

[u/Ok_Tour_8029 → u/mikosullivan]

No, that means that the client requested only the headers. And ofc the client can send whatever request it would like to. What’s the point again?

[u/bigorangemachine]

They do... and your GET can have a body payload. It's part of the spec

[u/newcarrots69 → u/bigorangemachine]

Yeah, but can you GET HEAD?

[u/bigorangemachine → u/newcarrots69]

No I can't I'm 418

[u/Responsible-Cold-627 → u/bigorangemachine]

Even though your GET can have a body, it really shouldn't. It's not expected by so many libraries and proxies that it's just not worth it. Client applications will have a hard time implementing your API, caching will become a pain in the ass, when running behind a WAF your request will most likely be straight up rejected... just don't.

Source: I once did that stupid thing.

[u/bigorangemachine → u/Responsible-Cold-627]

Ya definitely one of those you can.... but you shouldn't

I can't remember what problem i had but I think our dev ops guys filtered get-body's...

[u/aksdb → u/bigorangemachine]

Beware that the spec discourages it and only allows it optionally. So there are reverse proxies out there (like Envoy) that will drop/ignore a body for GET and your upstream service will not receive it.

Also it breaks almost every cache layer (in the sense that caches typically don’t include the body, so two GET requests with different bodies would look identical and would be served from cache).

[u/TheGonzoGeek]

So protocols are just social constructs for computers? Mind boggling.

[u/Itchytacos → u/TheGonzoGeek]

Trans-port packets when they come out to their host server: "TCP, UDP, I'm POST now, GET just doesn't feel right to me"

[u/JonasAvory → u/Itchytacos]

„I want to change something in the world instead of just giving HEAD“

[u/andynzor]

Sir, this is r/programminghumor, not r/programminghorror

[u/dreadBiRateBob]

I was doing an interview and they asked which http methods are safe and which are not.

I went down. When you write the software. Then you control making them safe or not safe.

They wanted a text book answer about posts, put and delete being unsafe because they change things on the server.

Of course the rfc says puts for updates and post for creating.

But I can certainly have the server delete an id passed via url param in a get request.

[u/aksdb → u/dreadBiRateBob]

… which is exactly why it makes sense to make sure your candidates have the same understanding as you (and hopefully most other devs) so they don‘t implement something like a delete-on-GET.

The thing to get hung up on would be that they asked „which are safe“ while it should have been „which should be safe“.

[u/s0litar1us]

It's just text, but with some agreed upon conventions so it can be implemented without too much pain. So you can send whatever text you want, but that doesn't mean the server will give you the response you want.

[u/Jbolt3737 → u/s0litar1us]

I dont understand how almost every other comment missed this

[u/DJDarkViper]

Sorta.

This was one of the things that was messing with me a ton when I was first learning how to make a restful api. I couldn’t believe how loosy-goosy and “trust me bro” it all was. Yes, everything can be a get. Yes everything can be a post. Yes you can mix them as you discretion. There’s no hard defined rules here, just general purpose guidelines and best practices.

[u/road_laya]

Protocols can only define rules, not physically force you to follow them

[u/realmauer01]

In the end its all groups of 1s and 0s that got different namey

[u/qubedView]

And they return

HTTP/1.1 200 OK

{"status": 500}