Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I’ve banned query strings

chrismorgan.info

Post reply on HN
Print view View original

191–200 of 317 posts

Re: I’ve banned query strings

#191

Post by dylan604 »

jedimastert wrote: post #20

You know I was actually really curious about this so I went back to the HTML and URL W3C standards and surprisingly they don't actually have any definitions of format other than being percent encoded. One might conflate query strings with "form-urlencoded"[0] query strings, which is one potential interoperability format, but in general a queries string is just any percent encoded string following a "?" in a url[1], a…

Wouldn't a generic 400 be better. It's not that the page wasn't found, but you've sent something that was not an accepted request. Fix your request and try again is how I've read it, and that's how I use it in the APIs I provide. I prefer it over 406 since it's not my end that can't process it. If your query string is tacking extra stuff trying to break things or just because your request wasn't crafted per the docs, then it's on you.

Re: I’ve banned query strings

#192

Post by kaelwd »

panzi wrote: post #147
wongarsu wrote: post #63

Earlier quoted context omitted.

Back in the day it was reasonably common for CMSs and forums to only have an index.php, and routing entirely by query string (in form-urlencoded form, people were not savages). So you would have index.php?p=home and index.php?p=shop. Or index.php?action=showthread&forum=42&thread=17976. It should be immediately obvious that in that scheme 404 is indeed the correct answer to unknown query parameters In fact lots of si…

watch?v=oHg5SJYRHA0

item?id=48076173

Re: I’ve banned query strings

#193

Post by stickfigure »

This basically boils down to "reject any incoming links from facebook, pinterest, chatgpt, linkedin, twitter, reddit, youtube, etc". I guess sure? There's a once-famous guy who shows goatse to all referring links from HN. I guess if you get enough traffic that you can pick which sources you want to allow, that's a good problem to have.

Re: I’ve banned query strings

#195

Post by varenc »

xp84 wrote: post #179

I love the hilarious output. He even coded in a special case for just a question mark without any params: https://chrismorgan.info/no-query-strings ? Never have I seen such a sassy web server

great spot!

I noticed that his server also doesn't accept URLs ending is a single `/`: https://chrismorgan.info/no-query-strings/

But instead of the banned query strings message, it just returns a very sassy not-a-404 page. Once again, this is violating a common convention, but there's nothing in the HTTP spec that requires treating these URLs the same. Similarly the site also 404s when you add extra slashes like https://chrismorgan.info///no-query-strings

digression: I love trying "domain.com//" on various sites. Occasionally it'll trigger weird errors like a 502 or 500.

Re: I’ve banned query strings

#196

Post by fpoling »

chrismorgan wrote: post #168
jedimastert wrote: post #20

You know I was actually really curious about this so I went back to the HTML and URL W3C standards and surprisingly they don't actually have any definitions of format other than being percent encoded. One might conflate query strings with "form-urlencoded"[0] query strings, which is one potential interoperability format, but in general a queries string is just any percent encoded string following a "?" in a url[1], a…

Yeah, URLs really don’t have much in the way of semantics. Path is clearly intended for hierarchical data and query for non-hierarchical data, and there are strong customs, some commonly supported or even enforced by libraries, but no actual rules. Ultimately, it’s just a string that the server can decide what to do with. The really funny thing about this is that, when I was worrying about possible side effects if I…

Wikipedia web server treats anything after /wiki/ literally as the name of the article.

So en.wikipedia.org/wiki/// is the article about C++ style comments

Re: I’ve banned query strings

#197

Post by Xirdus »

threatofrain wrote: post #137
Sander_Marechal wrote: post #110

Earlier quoted context omitted.

There is no reason you can return that "no items matched your selection" with a 404 HTTP response code instead of a 200.

A response code of 204 seems more appropriate but the problem is you're not allowed to send further information, which would make that descriptive response... not descriptive enough.

Code 204 is just code 200 with the "yes the body really is zero bytes this is not an error it's supposed to be like this" bit set.

Re: I’ve banned query strings

#198

Post by [deleted] »

em-bee wrote: post #153
altairprime wrote: post #133

Earlier quoted context omitted.

That’s not an indiscriminate hierarchy. Grouping data by user is common and normal in computing: /home laid precedent decades ago. Project directories are an extremely common grouping within a user’s work sets. Yeah, some of us just dump random files in $HOME, but this is still a sensible tier two path component. The choice to make ‘view metadata-wrapped content in browser HTML output’ the default rather than ‘view r…

actually, instead of the object hash, you could also use the commit-hash. then the filename would be mandatory, but the url would be more readable and usable: give me the file VERBS.md as it is at commit

[deleted]

Re: I’ve banned query strings

#199

Post by otabdeveloper4 »

chrismorgan wrote: post #167
wongarsu wrote: post #63

Earlier quoted context omitted.

Back in the day it was reasonably common for CMSs and forums to only have an index.php, and routing entirely by query string (in form-urlencoded form, people were not savages). So you would have index.php?p=home and index.php?p=shop. Or index.php?action=showthread&forum=42&thread=17976. It should be immediately obvious that in that scheme 404 is indeed the correct answer to unknown query parameters In fact lots of si…

> in form-urlencoded form, people were not savages Oh yeah? I remember a lot of semicolons from Perl and other CGI stuff where we would now use ampersands, back in the day, both in the path and in the query. (Sometimes the ? itself would be written ;.)

Correct. In fact, the semicolon is part of the URI scheme standard, and the ampersand is just some ad-hoc thing that got adopted naturally without any standardization effort.

Re: I’ve banned query strings

#200

Post by masklinn »

em-bee wrote: post #153
altairprime wrote: post #133

Earlier quoted context omitted.

That’s not an indiscriminate hierarchy. Grouping data by user is common and normal in computing: /home laid precedent decades ago. Project directories are an extremely common grouping within a user’s work sets. Yeah, some of us just dump random files in $HOME, but this is still a sensible tier two path component. The choice to make ‘view metadata-wrapped content in browser HTML output’ the default rather than ‘view r…

actually, instead of the object hash, you could also use the commit-hash. then the filename would be mandatory, but the url would be more readable and usable: give me the file VERBS.md as it is at commit

That's actually what it is here, a7e17290a39250092055fcda5ae7015868dabdb4 is a commit's oid: https://github.com/gritzko/beagle/commit/a7e17290a3925009205...
Post reply on HN