Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You know how HTTP GET requests are meant to be idempotent?

twitter.com

Post reply on HN
Print view View original

91–100 of 313 posts

Re: You know how HTTP GET requests are meant to be idempotent?

#91

Post by laneb »

jholman wrote: post #82
laneb wrote: post #73

Earlier quoted context omitted.

The typical operation applied to sets of functions is composition, so idempotency of a function f is the condition that f(f(x)) = f(x) for all x in the domain of f. I don't think that applies meaningfully to GET.

It does apply to HTTP idempotency. `x` is the state of the server. `f` is the change to the state of the server that ensues when one makes such-and-such an HTTP call. So taking PUT as an example, `x` is the state before the PUT, `f(x)` is the state after one PUT, and `f(f(x))` is the state after that single PUT is sent twice. Of course in a RFC7231-compliant server, `f(x) = f(f(x))`. Taking GET (or any other nullipot…

Ah yeah that makes sense.

Re: You know how HTTP GET requests are meant to be idempotent?

#93

Post by acdha »

joesb wrote: post #67

> "I threw the code together in minutes and was too lazy to spend another couple minutes figuring out POST." So it's not the vendor's problem then. They provide you with two ways to make a request. You have a choice to do it right, you didn't.

The device should not support GET at all for this. It opens up a number of attacks and there’s no good reason to support it.

Re: You know how HTTP GET requests are meant to be idempotent?

#94

Post by Y_Y »

StavrosK wrote: post #85
mbid wrote: post #78

Earlier quoted context omitted.

From wikipedia: "A unary operation f, that is, a map from some set S into itself, is called idempotent if, for all x in S, f(f(x)) = f(x)."

Yes, in mathematics, not programming. And a function that doubles a number isn't idempotent even by that definition.

Of course a doubling function is not idempotent!

I think the confusion arises because side-effectful functions can be considered as having type

    f :: (RealWorld, OtherArgs) -> (RealWorld, OtherOutputs)
and so for a garage door toggle you have something like

    t :: RealWorld -> RealWorld
where the new state is the old one with the door opened/closed as appropriate.

Now the idempotence condition becomes:

    t(t(world)) == t(world)
but clearly

       t(t(doorOpenWorld)
    =  t(doorClosedWorld)
    =  doorOpenWorld
    != t(doorOpenWorld)
    =  doorclosedWorld
so this is where the notion comes from. If you abuse notation and just say a function of no arguments can be idempotent then you'll get confusion like this.

Re: You know how HTTP GET requests are meant to be idempotent?

#96

Post by criddell »

bushin wrote: post #36
phamilton wrote: post #13

Earlier quoted context omitted.

> loose REST conventions REST is HTTP. "loose REST conventions" is when someone chose to ignore big chunks of the HTTP spec. In other words, you can build whatever you want (like SOAP) on top of HTTP and ignore the spec that describes content negotiation, HTTP methods, Caching policies, etc. It's still technically HTTP. But if you were to read the HTTP spec and follow it to a tee, you'd build a REST application.

> you'd build a REST application Nah, nerds would come out of the woodwork to inform you that what you've built is not a real REST.

Yeah - there's always a HATEOAS comment somewhere and I've never really managed to figure out what that means beyond using URI's rather than a database IDs + some documented endpoint path to point to other resources.

Re: You know how HTTP GET requests are meant to be idempotent?

#97

Post by acdha »

DCoder wrote: post #83

Many years ago, I was asked to look at why all the content had vanished from a site (not built by me). After digging in a bit, I found that: 1) the original developer's idea of handling an unauthorized /admin request was just to set a redirect header and continue processing the current request . 2) the /admin page had a grid of all the content on the site, with handy 'Delete' links that ran over GET without confirmat…

There were at least two browser extensions which also discovered that poor design was widespread and to disable prefetching for similar reasons:

http://fasterfox.mozdev.org/index.html

https://signalvnoise.com/archives2/google_web_accelerator_he...

I think the state of the web has improved slightly over the last decade but this is a great example of why browser vendors are so conservative. You can do this now but only opt-in.

Re: You know how HTTP GET requests are meant to be idempotent?

#98

Post by shocks »

andai wrote: post #95
shocks wrote: post #92

My desk height is set with a GET. I was going to fix it, but considering how hilarious this is I might not.

Your desk runs a web server? I need to step up my game...

Yeah, it's a sit/stand Linak desk.

I hooked up an ESP32, 2 channel relay (up/down control), and distance sensor (to detect height). Pushes height to graphite and position is settable remotely. :)

Re: You know how HTTP GET requests are meant to be idempotent?

#99

Post by swiley »

mbid wrote: post #78
StavrosK wrote: post #74

Earlier quoted context omitted.

I dispute your example. If you call f(2) and it always returns 4, it's idempotent and side-effect-free. If you call f() and it returns 4, then 8, etc, it is neither.

From wikipedia: "A unary operation f, that is, a map from some set S into itself, is called idempotent if, for all x in S, f(f(x)) = f(x)."

I think because in math you don’t ever have side effects you usually use composition where in programming you usually use a sequence. So to change that function in to how people would implement it means rearranging the internal stuff and then it probably wouldn’t be idempotent be either definition.
Post reply on HN