Live data from Hacker News

You know how HTTP GET requests are meant to be idempotent?

twitter.com

121–130 of 313 posts

Re: You know how HTTP GET requests are meant to be idempotent?

#121
post #117

Two thoughts: 1) Twitter is a terrible medium for anything, let alone posts longer than a sentence. 2) The level of over-engineering tech people readily engage in without a second thought is truly mind boggling.

1) Market disagrees with you strongly, hence hundreds of millions of people using it regularly. 2) He's just having fun, working on a side project that's useful to him, and learning. Nothing wrong with any of that. Why so negative?

1) Popularity is rarely an indicator of quality.

2) That doesn't mean it isn't over-engineering.

Re: You know how HTTP GET requests are meant to be idempotent?

#122
post #15

When I recently added 'click to unsubscribe' functionality to my emails, the URL got wrote out into some logs. Those logs got written to a Slack channel and Slack loves to click any link it sees. Oh, and it doesn't respect robots.txt. But all I saw was every member of my list clicking 'unsubscribe'. It took a good hour to figure out exactly what was going on. Idempotence is not the problem here, by the way. That just…

If the unsubscribe link were unique for each subscriber would the law still be satisfied?

Re: You know how HTTP GET requests are meant to be idempotent?

#123
post #36

Earlier quoted context omitted.

> you'd build a REST application Nah, nerds would come out of the woodwork to inform you that what you've built is not a real REST.

Yeah - there's always a HATEOAS comment somewhere and I've never really managed to figure out what that means beyond using URI's rather than a database IDs + some documented endpoint path to point to other resources.

It's pretty simple – the information a client needs to transition from one state to another needs to be encoded in the documents. So if you were to design a garage door opener, a non-REST specification might say something like:

    To get the door status, GET https://example.com/status  
    
    To open the door, POST to https://example.com/open  
    
    To close the door, POST to https://example.com/close
A REST approach might use a document something like this:

    {
        "doorState": "closed",
        "actions": [
            {
                "label": "Open the door",
                "href": "/open",
                "method": "POST"
            }
        ]
    }
Then, upon a client performing an "Open the door" action, the server would then respond with a document like this:

    {
        "doorState": "open",
        "actions": [
            {
                "label": "Close the door",
                "href": "/close",
                "method": "POST"
            }
        ]
    }
…and vice-versa. So at any given point, the web service is describing to the client what the state is and how to transition to other states. There's quite a few different benefits to doing it this way – for instance, if you wanted to add a "Turn the garage light on" feature, you could just add the action into the API and clients would be able to use it without any changes whatsoever. Or if you wanted to disable an action, you'd simply remove it from the actions array and the client wouldn't present it to the user as an option. Want to A/B test different label text? You don't need any special A/B testing functionality in the client, just vary the responses you send to users and observe which actions they take. Want to translate into different languages? Just take a look at the Accept-Language header coming from the client and respond with the right label text.

In practice, you'd want to use a vocabulary that's already out there like Hydra instead of coming up with your own format. But it can sometimes take a little time to get up to speed with them because they are necessarily quite flexible. But you can get most of the way there by simply thinking about it in terms of "the server tells the client what to do and how to do it".

For something as simple as a garage door that you are certain will never need to change? The benefits REST brings probably aren't going to be worth much to you. But as the complexity of an API grows, the point at which it's easier to use REST than not arrives very quickly.

If you want to read more about this, the best book I've found on the subject is RESTful Web APIs: http://restfulwebapis.com/

Re: You know how HTTP GET requests are meant to be idempotent?

#124
post #59

Earlier quoted context omitted.

This still seems like really bad idea when the POST request is right there. Serve a page with a button saying "are you sure"?

Do you really like having to confirm every action? For interfaces that you use all the time, it's nice to be able to eliminate extra steps.

If you're using it programatically (e.g., a script that's calling curl), it's absolutely no trouble to use POST.

If you're using it from a browser, you can write it with a confirmation page for simple browsers, but also use just a little javascript in normal browsers to convert the GET to a POST and skip the confirmation page.

Re: You know how HTTP GET requests are meant to be idempotent?

#125
post #34

Earlier quoted context omitted.

GET requests should have no side effects. In other words NOOP is idempotent

Reading from a database isn’t “side effect free”, neither is reading from a mutable variable. Given that HTTP requests are supposed to trigger database reads that may return a different result after some time, then “side effect free” would indeed be incorrect. The litmus test is ... does it always return the same output given the same input? If that can change, the it’s not describing a pure function, but a side effe…

[deleted]

Re: You know how HTTP GET requests are meant to be idempotent?

#126
post #116

Earlier quoted context omitted.

Having a single confirmation step to prevent "oops" clicks doesn't seem like a dark pattern to me.

The majority of people who clicked on the link did it on purpose, so a better pattern would be to make it unsubscribe immediately with a "didn't meant to unsubscribe? click here to undo" link afterwards.

The thread is talking about situations where an automated system would 'click' the link though. The automated system is probably not going to go "oh oops, resubbed"

You could probably automate the POST action though. Equivalent of $('#unsub-button').click() on the unsubscribe page load

Re: You know how HTTP GET requests are meant to be idempotent?

#127
This is pretty much the classic newbie web developer mistake, heard many stories about people making it when they first start. I've also seen people fuck up in the opposite way, using POST when they should use GET and having unexpected behavior. Though not usually as "funny" as the classic "using GET instead of POST" errors are.

This concept of HTTP request methods really should be explained to new developers in a more accessible way, with examples of mistakes. It might not be intuitive at first or they might not think it's important as it is.

"Idempotence" isn't really the problem here, nor "should" GET requests be idempotent, think kittenwar.com or stumbleupon, the problem here is GET is reserved for retrieving (getting!) data, it shouldn't modify data. (Other than access information.)

Re: You know how HTTP GET requests are meant to be idempotent?

#128
post #59

Earlier quoted context omitted.

This still seems like really bad idea when the POST request is right there. Serve a page with a button saying "are you sure"?

A reboot of the machine isn't the end of the world and far less risky than a garage door randomly opening. It probably needed it anyway as they tend to degrade over time. This is a very specific usecase. If it becomes an issue, I can always push out an update of the software that switches things to POST (thanks to using the golang library, overseer).

It still seems a bit odd to do it this way when it's so easy to do it right.

I hope the hostnames / IP addresses aren't predictable, because all it would take to cause trouble is to send an HTML email containing something like " rel="nofollow">http://192.168.0.1/reboot"> to your staff and then you'd trigger a bunch of reboots whenever anybody opened their email. Or just send a link to a page that does the same thing. Or text a link to them and wait for iMessage or whatever to preload the page to get the preview. There's so many different ways to trigger an automatic GET precisely because GET is defined to be safe.

Re: You know how HTTP GET requests are meant to be idempotent?

#130
post #127

This is pretty much the classic newbie web developer mistake, heard many stories about people making it when they first start. I've also seen people fuck up in the opposite way, using POST when they should use GET and having unexpected behavior. Though not usually as "funny" as the classic "using GET instead of POST" errors are. This concept of HTTP request methods really should be explained to new developers in a mo…

GET requests are specified[0] to be idempotent:

  > Methods can also have the property of "idempotence" in that (aside from
  > error or expiration issues) the side-effects of N > 0 identical
  > requests is the same as for a single request. The methods GET, HEAD,
  > PUT and DELETE share this property.
[0] https://tools.ietf.org/html/rfc2616#section-9.1.2

edit: formatting

Post reply on HN