JSON in URLs
blogs.dropbox.com
JSON in URLs
1–10 of 38 posts
Re: JSON in URLs
#2JSON in URL: /log?%7B%22a%22:%22b%22,%22c%22:4%7D
You are debugging and need to quickly identify the values you are passing to the API. Better have a JSON parser handy.
Re: JSON in URLs
#3A little confused. The author is arguing _against_ JSON in URLs, right?
The piece starts as a list of complaints about hacky query parameter encoding, and has the feel of one of those "aren't these things annoying... but here's the right answer!" posts, except instead of a correct answer we get a discussion of how JSON is nice in some cases but we shouldn't use it in URLs, except maybe sometimes.
Is this a response to some post about how JSON _should_ be used in URLs? Overall, I struggled to find a coherent narrative / argument here. Perhaps something went wrong in the article's editing process.
Re: JSON in URLs
#4When I pass around any parameters in GET or POST parameters I wrap them in base64. That makes a lot of escaping bugs go away (and adds a bit of "security by obscurity", as well as true security when combining the query with a random number, a sha256 hash of the parameters and a serverside secret).
Re: JSON in URLs
#5JSON in URL: /log?%7B%22a%22:%22b%22,%22c%22:4%7D You are debugging and need to quickly identify the values you are passing to the API. Better have a JSON parser handy.
This is already a problem if you ever have to work with non-ASCII characters. Check out a URL to a page in the Japanese Wikipedia, for instance.
Re: JSON in URLs
#6A little confused. The author is arguing _against_ JSON in URLs, right? The piece starts as a list of complaints about hacky query parameter encoding, and has the feel of one of those "aren't these things annoying... but here's the right answer!" posts, except instead of a correct answer we get a discussion of how JSON is nice in some cases but we shouldn't use it in URLs, except maybe sometimes. Is this a response t…
no...author is suggesting to use JSON in URLs..
Re: JSON in URLs
#7A little confused. The author is arguing _against_ JSON in URLs, right? The piece starts as a list of complaints about hacky query parameter encoding, and has the feel of one of those "aren't these things annoying... but here's the right answer!" posts, except instead of a correct answer we get a discussion of how JSON is nice in some cases but we shouldn't use it in URLs, except maybe sometimes. Is this a response t…
The argument is that JSON in URLs offers better abstraction.
Re: JSON in URLs
#8JSON in URL: /log?%7B%22a%22:%22b%22,%22c%22:4%7D You are debugging and need to quickly identify the values you are passing to the API. Better have a JSON parser handy.
This is already a problem if you ever have to work with non-ASCII characters. Check out a URL to a page in the Japanese Wikipedia, for instance.
Re: JSON in URLs
#9Well that has a smell doesn't it. There may be a use case where you feel the need to stuff a url with json data, but it sure feels wrong.
Re: JSON in URLs
#10Even this article's final conclusion is that this is a bad idea.
Data within the URL also has a number of other issues including:
- It is easier to leak (e.g. browser history, proxies, some browser extensions, etc). Very few things record HTTP POST parameters unless they're doing something evil, very many non-evil pieces of software record the full URL.
- Users intentionally or inadvertently re-posting data is much more likely. No browser's autocomplete re-posts HTTP POST parameters to the website, many will do so with HTTP GET parameters, which could result in a worse user experience (or in rare cases the user performing actions on your website within intending to).
- Maximum length
- The encoding/decoding step could be extremely expensive for some data. JSON itself requires a lot of decoding but depending on what you're moving it could mean almost all of the data requires it making the URL string insanely massive.
- Users will copy/paste these URLs to one another and the JSON will remain in all its 200+ character ugly glory. This may not be a security issue but it is a user perception issue. URLs are meant to be getting cleaner/more human readable.