7

Possible Duplicates:
How should I choose between GET and POST methods in HTML forms?
When do you use POST and when do you use GET?

Obviously, you should. But apart from doing so to fulfil the HTTP protocol, are there any reasons to do so? Less overhead? Some kind of security thing?

Community
  • 1
  • 1
cwap
  • 11,087
  • 8
  • 47
  • 61

8 Answers8

21

because GET must not alter the state of the server by definition.

see RFC2616 9.1.1 Safe Methods:

9.1.1 Safe Methods

Implementors should be aware that the software represents the user in their interactions over the Internet, and should be careful to allow the user to be aware of any actions they might take which may have an unexpected significance to themselves or others.

In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested.

If you use GET to alter the state of the server then a search engine bot or some link prefetching extension in a web browser can wreak havoc on your site and (for example) delete all user data just by following links to your site.

levinalex
  • 5,889
  • 2
  • 34
  • 48
  • 4
    idempotent is the word you're looking for - http://en.wikipedia.org/wiki/Idempotence – Russ Cam Aug 10 '09 at 10:27
  • 5
    not really, no. Indempotent means that repeating the same request does not change the result. PUT and DELETE shoult also be idempotent (but are not safe) – levinalex Aug 10 '09 at 10:30
11

There is a nice paper by the W3C about this: URIs, Addressability, and the use of HTTP GET and POST.

1.3 Quick Checklist for Choosing HTTP GET or POST

  • Use GET if:
    • The interaction is more like a question (i.e., it is a safe operation such as a query, read operation, or lookup).
  • Use POST if:
    • The interaction is more like an order, or
    • The interaction changes the state of the resource in a way that the user would perceive (e.g., a subscription to a service), or
    • The user be held accountable for the results of the interaction
Joey
  • 344,408
  • 85
  • 689
  • 683
7

Because, if you use GET to alter state, Google can delete your stuff.

Tommy Carlier
  • 7,951
  • 3
  • 26
  • 43
4

When do you use POST and when do you use GET?

How should I choose between GET and POST methods in HTML forms?

Community
  • 1
  • 1
rahul
  • 184,426
  • 49
  • 232
  • 263
2

If you accept GETs to perform write operations then a malicious hacker could inject somewhere links to perform an unauthorized operation. Your user clicks on a link - and something is deleted from a database. Or maybe some amount of money is transferred away from the user's account if he's still logged in to their online banking.

http://superbank.com/TransferMoney?amount=1000&recipient=2342524

Send a malicious email with an embedded image referencing this link, and as soon as the document is opened, something funny has happened behind the scenes.

  • 1
    While this is correct, it wouldn't be much more difficult for a half-competent hacker to trick you into performing a malicious POST request instead. – LukeH Aug 10 '09 at 10:34
  • But this would be a trick, which can be countered, while image-get is perfectly legal operation – ymv Aug 10 '09 at 10:42
  • @ymv: Yes, but you accepting a GET command over a link to update your stuff would be foolish. –  Aug 10 '09 at 10:45
  • @LukeH How a user can be tricked to perform a malicious POST request? Please give an example. – gom Nov 19 '12 at 21:26
0

GET is limited by the length of URL the browser/server can handle. This used to be as short as 256 characters.

  • There is no such limit in HTTP spec. In practice, limits are higher than 256 characters. – Peter Štibraný Aug 10 '09 at 10:30
  • 1
    2000 chars should be regarded as the current practical limit. See http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-an-url – Paul Dixon Aug 10 '09 at 10:30
  • "Used to be". I looked at POST vs GET back in 1997 and the reason I give here was what I found then. –  Aug 10 '09 at 21:14
0

There is atleast one situation where you want a GET to change data on the server. That is when a GET returns data, and you need to record which data was given to a user and when it was given.

If you use complex data types then it must be in a POST it cannot be in a GET. For example testing a WCF web service in a browser can only be done when the contract uses simple data types.

Using GET and POST where it is expected helps to keep your program understandable.

Shiraz Bhaiji
  • 64,065
  • 34
  • 143
  • 252
-5

When you use POST, you can see the information being "posted" in the address-bar of the web browser. This is [apparently] not the case when you use the GET method.

This article was somewhere on http://www.w3schools.com/ Once I've found the exact page it was on, I'll repost. :-)

jay_t55
  • 11,362
  • 28
  • 103
  • 174