Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You know how HTTP GET requests are meant to be idempotent?

twitter.com

Post reply on HN
Print view View original

31–40 of 313 posts

Re: You know how HTTP GET requests are meant to be idempotent?

#31

Post by beobab »

poizan42 wrote: post #22
javajosh wrote: post #18

Earlier quoted context omitted.

It would be sufficient to GET a resource that uses a script to POST the side-effect. Slack's user-agent probably isn't sophisticated enough to mess this up (although heaven help us when they implement their preview with something like headless chrome).

What would the problem be in just showing a button that says "Confirm unsubscribe" that sends a POST request? A lot of sites does something like that for their newsletter unsubscription.

That would comply with GDPR, and is a valid solution.

Re: You know how HTTP GET requests are meant to be idempotent?

#32

Post by thomasz »

beejiu wrote: post #15

When I recently added 'click to unsubscribe' functionality to my emails, the URL got wrote out into some logs. Those logs got written to a Slack channel and Slack loves to click any link it sees. Oh, and it doesn't respect robots.txt. But all I saw was every member of my list clicking 'unsubscribe'. It took a good hour to figure out exactly what was going on. Idempotence is not the problem here, by the way. That just…

“Toggle” is by definition not idempodent, because you get a different result each and every time. “Open” and “close” are idempodent, but not safe. The result of a GET request should always be idempodent and safe.

Re: You know how HTTP GET requests are meant to be idempotent?

#33

Post by tzahola »

peteretep wrote: post #25
phamilton wrote: post #13

Earlier quoted context omitted.

> loose REST conventions REST is HTTP. "loose REST conventions" is when someone chose to ignore big chunks of the HTTP spec. In other words, you can build whatever you want (like SOAP) on top of HTTP and ignore the spec that describes content negotiation, HTTP methods, Caching policies, etc. It's still technically HTTP. But if you were to read the HTTP spec and follow it to a tee, you'd build a REST application.

> REST is HTTP This is untrue. I hate to quote from Wikipedia, but it sums it up quite nicely: "REST is not a standard in itself, but RESTful implementations make use of standards, such as HTTP, URI, JSON, and XML" More colloquially: REST is what happens when people mix up transport layers in their head.

HTTP is an implementation of REST.

Re: You know how HTTP GET requests are meant to be idempotent?

#34

Post by dewiz »

thomasz wrote: post #32
beejiu wrote: post #15

When I recently added 'click to unsubscribe' functionality to my emails, the URL got wrote out into some logs. Those logs got written to a Slack channel and Slack loves to click any link it sees. Oh, and it doesn't respect robots.txt. But all I saw was every member of my list clicking 'unsubscribe'. It took a good hour to figure out exactly what was going on. Idempotence is not the problem here, by the way. That just…

“Toggle” is by definition not idempodent, because you get a different result each and every time. “Open” and “close” are idempodent, but not safe. The result of a GET request should always be idempodent and safe.

GET requests should have no side effects. In other words NOOP is idempotent

Re: You know how HTTP GET requests are meant to be idempotent?

#35

Post by cottsak »

The intersection of full-stack web devs from the commercial line-of-business world; and hardware/embedded hackers brings a lot of room for accidents IMO. I'm not saying any one of these groups are bad or inept. I'm in the former and completely accept that I'm new to embedded programming. It seems kool and I wanna learn about it. But I can also see the flip side where a hardware hacker sees query strings for toggling an output as a perfectly reasonable interface. Do we expect the embedded guys to grok HTTP/REST? The web-dev would be like "no, no, that has to be POST or PUT". But these things are going to happen. We don't yet have a large pool of experts across both fields.

It's no surprise the level of compromise and breach when you intersect what were pretty distinct skillsets and dump them in the mixing bowl together. That's what this IoT thing is like - it's a bunch of household and industrial chemicals all poured into the one container. It's not going to be very safe.

Re: You know how HTTP GET requests are meant to be idempotent?

#36

Post by bushin »

phamilton wrote: post #13
guelo wrote: post #6

Is idempotency part of HTTP or just part of loose REST conventions?

> loose REST conventions REST is HTTP. "loose REST conventions" is when someone chose to ignore big chunks of the HTTP spec. In other words, you can build whatever you want (like SOAP) on top of HTTP and ignore the spec that describes content negotiation, HTTP methods, Caching policies, etc. It's still technically HTTP. But if you were to read the HTTP spec and follow it to a tee, you'd build a REST application.

> you'd build a REST application

Nah, nerds would come out of the woodwork to inform you that what you've built is not a real REST.

Re: You know how HTTP GET requests are meant to be idempotent?

#38

Post by wpearse »

wpearse wrote: post #29

Hello! Long-time lurker, and guilty dev behind the garage door. You can see the (broken) code I wrote here: https://github.com/wpearse/wemos-d1-garage-door-wifi I'll get around to fixing it later this week. Also, an apology: I should have used "side-effect-free" instead of "idempotent" in my tweets.

Fixed now: https://github.com/wpearse/wemos-d1-garage-door-wifi/commit/...

I think.

edit: updated link because left creds in the commit :-/

Re: You know how HTTP GET requests are meant to be idempotent?

#39

Post by bjackman »

wpearse wrote: post #29

Hello! Long-time lurker, and guilty dev behind the garage door. You can see the (broken) code I wrote here: https://github.com/wpearse/wemos-d1-garage-door-wifi I'll get around to fixing it later this week. Also, an apology: I should have used "side-effect-free" instead of "idempotent" in my tweets.

Anything side-effect-free is idempotent too, I suppose

Re: You know how HTTP GET requests are meant to be idempotent?

#40

Post by wpearse »

tudorconstantin wrote: post #37

Also, having your garage door opened with unauthorized requests seems like looking for trouble

Yeah, did wonder about that. My thinking at the time was that the device was on the local WiFi network, not exposed to the internet, and there would be easier ways of getting into the garage if you really wanted to.
Post reply on HN