Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #14538

Re: GET vs POST in AJAX

Show all headers | View raw

On 2012-06-16 21:22, Daniel Pitts wrote:
> On 6/16/12 4:13 AM, Stefan Weiss wrote:
>> As you say, the difference is mostly semantic. In a nutshell,
>>
>> - GET retrieves information from the server. It should not have any
>> other side effects changing the state on the server, or at least the
>> client may assume that the request is "safe".

> Actually, I recall reading somewhere that "GET" need only be idempotent. 
> The first call is allowed to change server state, but calling it over 
> and over again will have no further effect.

I've never heard that before. It would be be interesting to know where
you read that. The RFC 2616 states that

| In particular, the convention has been established that the GET
| and HEAD methods SHOULD NOT have the significance of taking an
| action other than retrieval. These methods ought to be considered
| "safe". This allows user agents to represent other methods, such
| as POST, PUT and DELETE, in a special way, so that the user is made
| aware of the fact that a possibly unsafe action is being requested.

GET should be idempotent in addition to being safe.

There was a famous case of SNAFU involving a company's intranet web
application and manager who had installed the Alexa toolbar. Every time
the manager used the web app, data would mysteriously go missing. It
turned out that the reason for this was some kind of link pre-fetching
feature in the Alexa toolbar in combination with links like this in the
web app:

<a href="/foo/deleteItem?id=12345" onclick="return confirm(...)">...</a>

The prefetcher ignored the script and went on to call the "deleteItem"
action for all items in view.

This should serve as a lesson for never using GET when the resulting
action isn't safe.

- stefan

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GET vs POST in AJAX CODEY <ed.pataky@gmail.com> - 2012-06-15 18:16 -0700
  Re: GET vs POST in AJAX Andrew Poulos <ap_prog@hotmail.com> - 2012-06-16 13:31 +1000
    Re: GET vs POST in AJAX CODEY <ed.pataky@gmail.com> - 2012-06-21 15:43 -0700
  Re: GET vs POST in AJAX Jason C <jwcarlton@gmail.com> - 2012-06-15 21:14 -0700
  Re: GET vs POST in AJAX Stefan Weiss <krewecherl@gmail.com> - 2012-06-16 13:13 +0200
    Re: GET vs POST in AJAX Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-06-16 12:22 -0700
      Re: GET vs POST in AJAX Stefan Weiss <krewecherl@gmail.com> - 2012-06-16 21:58 +0200
        Re: GET vs POST in AJAX Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-06-16 13:26 -0700
          Re: GET vs POST in AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-17 09:06 +0200
            Re: GET vs POST in AJAX Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-06-17 20:57 -0700
              Re: GET vs POST in AJAX Stefan Weiss <krewecherl@gmail.com> - 2012-06-18 15:23 +0200
                Re: GET vs POST in AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-18 20:17 +0200
                Re: GET vs POST in AJAX Stefan Weiss <krewecherl@gmail.com> - 2012-06-19 03:41 +0200
                Re: GET vs POST in AJAX Andrew Poulos <ap_prog@hotmail.com> - 2012-06-19 12:25 +1000
                Re: GET vs POST in AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-19 19:19 +0200
                Re: GET vs POST in AJAX Dr J R Stockton <reply1225@merlyn.demon.co.uk.not.invalid> - 2012-06-19 20:44 +0100
              Re: GET vs POST in AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-18 20:14 +0200

csiph-web