Is GET stateless ?

[Andy Dingley]

"A GET is not supposed to change the state of the resource"
(compared to a POST, which obviously can)

Now this isn't my statement, I don't personally support it, it's
clearly breached on a regular basis and I can;t find anything in RFC
2616 et al. to support it.

What does the team think ?

[Alan J. Flavell]

On Mon, 15 Sep 2003, Andy Dingley wrote:

"A GET is not supposed to change the state of the resource"
(compared to a POST, which obviously can)

Now this isn't my statement, I don't personally support it, it's
clearly breached on a regular basis and I can;t find anything in RFC
2616 et al. to support it.

What does the team think ?

The clap-o-meter says:

http://www.w3.org/Protocols/rfc2616/....html#sec9.1.2

___
/
Methods can also have the property of "idempotenc e" in that (aside
from error or expiration issues) the side-effects of N > 0 identical
requests is the same as for a single request. The methods GET, HEAD,
PUT and DELETE share this property. Methods can also have the
property of "idempotenc e" in that (aside from error or expiration
issues) the side-effects of N > 0 identical requests is the same as
for a single request. The methods GET, HEAD, PUT and DELETE share this
property.
\___

[Jim Dabell]

Andy Dingley wrote:

"A GET is not supposed to change the state of the resource"
(compared to a POST, which obviously can)

Now this isn't my statement, I don't personally support it, it's
clearly breached on a regular basis and I can;t find anything in RFC
2616 et al. to support it.

What does the team think ?

The relevant part of RFC 2616 is:

"In particular, the convention has been established that the GET and HEAD
methods SHOULD NOT have the significance of taking an action other than
retrieval. These methods ought to be considered "safe". This allows user
agents to represent other methods, such as POST, PUT and DELETE, in a
special way, so that the user is made aware of the fact that a possibly
unsafe action is being requested."

-- <URL:http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9. 1>

It's not a MUST NOT, only a SHOULD NOT, but I think it should be listened to
in virtually all cases. If you really must use GET for a "non-safe"
action, then you'll probably want to respond with a redirection once the
transaction has gone through, to avoid problems where the user hits reload.

Why don't you support it? Is there anything useful non-safe GET actions can
do that you cannot do any other way?
--
Jim Dabell

[Randal L. Schwartz]

>>>>> "Jim" == Jim Dabell <ji********@jim dabell.com> writes:

Jim> Why don't you support it? Is there anything useful non-safe GET actions can
Jim> do that you cannot do any other way?

You can't make a link like

<a href="/some/cgi/script?id=123"> delete this item</a>

that isn't a button.

Of course, indexers will be happy to follow this link, and delete your
item. :)

--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - [phone]
<me****@stonehe nge.com> <URL:http://www.stonehenge. com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.St onehenge.com for onsite and open-enrollment Perl training!

[Geoff Berrow]

I noticed that Message-ID:
<58************ *************** ***@news.terane ws.com> from Randal L.
Schwartz contained the following:

You can't make a link like

<a href="/some/cgi/script?id=123"> delete this item</a>

that isn't a button.

Of course, indexers will be happy to follow this link, and delete your
item. :)

Bugger, hadn't thought of that[1]. How would you do it with a button?

[1]the page is password protected so indexers will not see it - I hope.
--
Geoff Berrow
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Jukka K. Korpela]

Geoff Berrow <$b**@ckdog.co. uk> wrote:

You can't make a link like

<a href="/some/cgi/script?id=123"> delete this item</a>

that isn't a button.

Of course, indexers will be happy to follow this link, and delete your
item. :)

Bugger, hadn't thought of that[1]. How would you do it with a button?

<form action="/some/cgi/script?id=123" method="POST">
<div><input type="submit" value="delete this item"></div>
</form>

It is debatable whether you could alternatively use

<form action="/some/cgi/script" method="GET">
<div><input type="submit" value="delete this item">
<input type="hidden" name="id" value="123"></div>
</form>

It might be argued that this violates a principle of using GET for fetch
operations only, but technically the protocol implies no such limitation.
If the delete operation is defined in the obvious way, so that trying to
delete something nonexistent has no effect (except sending back a warning
or an error message, perhaps), then it's idempotent.

Similar considerations apply to using a simple link. But in addition to
that, using a link for such a purpose is misleading. Links are supposed to
specify relationships, not actions. So even if you could, technically, set
up a link so that following the link makes a satellite self-destruct, and
you would not violate Internet protocols that way (the operation is surely
idempotent), you could hardly make the user responsible for the action.

--
Yucca, http://www.cs.tut.fi/~jkorpela/
Pages about Web authoring: http://www.cs.tut.fi/~jkorpela/www.html

[Geoff Berrow]

I noticed that Message-ID: <Xn************ *************** **@193.229.0.31 >
from Jukka K. Korpela contained the following:

Bugger, hadn't thought of that[1]. How would you do it with a button?

<form action="/some/cgi/script?id=123" method="POST">
<div><input type="submit" value="delete this item"></div>
</form>

Ah, a form. I knew that way, I thought there was another way I was not
aware of. I think I will change it so that each item has a check box and
then use a form button to delete selected items.

--
Geoff Berrow
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[James Taylor]

In article <Xn************ *************** **@193.229.0.31 >,
Jukka K. Korpela <jk******@cs.tu t.fi> wrote:

<form action="/some/cgi/script?id=123" method="POST">
<div><input type="submit" value="delete this item"></div>
</form>
Is it allowed to supply a query string in the URL of a POST?
Does it depend on the browser or server software in use?
idempotent.

This word is new to me and it's not in my Oxford Dictionary.
Can anyone enlighten me about its etymology?

--
James Taylor, Cheltenham, Gloucestershire , UK. PGP key: 3FBE1BF9
To protect against spam, the address in the "From:" header is not valid.
In any case, you should reply to the group so that everyone can benefit.
If you must send me a private email, use james at oakseed demon co uk.

[Headless]

James Taylor wrote:

Don't cross post replies please.

idempotent.

This word is new to me and it's not in my Oxford Dictionary.
Can anyone enlighten me about its etymology?

idempotent i¢dem*po*tent or i*dem¢pe*tent, (mathematics)
adjective and noun (of) a quantity which does not change value when
multiplied by itself.

(c) Larousse plc. All rights reserved
Headless

--
Email and usenet filter list: http://www.headless.dna.ie/usenet.htm

[Alan J. Flavell]

On Mon, Sep 15, James Taylor inscribed on the eternal scroll:

idempotent.
This word is new to me and it's not in my Oxford Dictionary.

You've been sold short. There's a sizeable web page on it in the
online OED. (The university conveniently has a subscription ;-)
Can anyone enlighten me about its etymology?

It's Latin, innit? idem = same, + potent(em) = powerful.

However, the thing to watch out for in its HTTP usage is that it does
_not_ mean that the operation has no effect. It only means that if
the operation is repeated, the effect is no different. Often loosely
explained as "producing no side-effects".