CODEWITHSUNDEEP
httpweb-applications
IAmYourFaja
IAmYourFaja

Reputation: 56934

Abusing HTTP POST

Currently reading Bloch's Effective Java (2nd Edition) and he makes a point to state, in bold, that overusing POSTs in web applications is inherently bad. Unfortunately, he doesn't specify why.

This startled me, because when I do any web development, all I ever use are POSTs! I have always steered clear of GETs for security reasons and because it felt more professional (long, unsightly URLs always bother me for some reason).

Are there performance differentials between GET and POST? Can anyone elaborate on why overusing POSTs is bad, and why? My understanding - and preliminary searches - seem to all indicate that these two are handles very similarly by the web server. Thanks in advance!

Upvotes: 2

Views: 222

Answers (3)

Raphael R.
Raphael R.

Reputation: 24284

You should almost always use GET when requesting content. Only use POST when you are either:

  • Transmitting sensitive information which should not appear in the URL bar, or
  • Changing the state on the server (adding/changing/deleting stuff, altough recently some web applications use POST to change, PUT to add and DELETE to delete.)

Here's the difference: If you want to give the link to the page to a friend, or save it somewhere, or even only add it to your bookmarks, you need the full URL of the page. Just like your address bar should say http://stackoverflow.com/questions/7810876/abusing-http-post at the moment. You can Ctrl-C that. You can save that. Enter that link again, you're back at this page.

Now when you use any action other than GET, there is simply no URL to copy. It's like your browser would say you are at http://stackoverflow.com/question. You can't copy that. You can't bookmark that. Besides, if you would try to reload this page, your browser would ask you whether you want to send the data again, which is rather confusing for the non-tech-savy users of your page. And annoying for the entire rest.

However, you should use POST/PUT when transferring data. URL's can only be so long. You can't transmit an entire blog post in an URL. Also, if you reload such a page, You'll almost certainly double-post, because the above described message does not appear.

GET and POST are very different. Choose the right one for the job.

Upvotes: 2

Chinmoy
Chinmoy

Reputation: 1754

If you are using POST for security reasons, I might drop a mention of other security factors here. You need to ensure that you send the data from a form submit in encrypted form even if you are using POST.

As for the difference between GET and POST, it is as simple as GET is used to send a GET request. So, you would want to get data from a page and act upon it and that is the end of everything.

POST on the other hand, is used to POST data to the application. I am talking about transactions here (complete create, update or delete operations).

If you have a sensitive application that takes, say and ID to delete a user. You would not want to use GET for it because in that case, a witty user may raise mayhem simply changing the ID at the end of the URL and deleting all random uses.

POST allows more data and can be hacked to send streams of files as well. GET has a limited size though.

There is hardly any tradeoff in using GET or POST.

Upvotes: 1

JB Nizet
JB Nizet

Reputation: 692023

You should use HTTP as it's supposed to be used.

GET should be used for idempotent, read queries (i.e. view an item, search for a product, etc.).

POST should be used for create, delete or update requests (i.e. delete an item, update a profile, etc.)

GET allows refreshing the page, bookmark it, send the URL to someone. POST doesn't allow that. A useful pattern is post/redirect/get (AKA redirect after post).

Note that, except for long search forms, GET URLs should be short. They should usually look like http://www.foo.com/app/product/view?productId=1245, or even http://www.foo.com/app/product/view/1245

Upvotes: 4

Related Questions