Hacker News Reader

Comment by romaniv | Hacker News Reader

"Don't use query parameters to alter state" "Don't fall into RPC with your URIs"

I can see the benefit of doing some of the things on the list, but I never understood what's the motivation behind these two suggestions. What are the practical benefits? (Specifically, what are the benefits for a web application, rather than a web app?)

I can give you some considerable benefits of doing the opposite. My favorite URL scheme looks like this: "http://example.com/?Class.method.id.parts&param=x.

It enables automatic routing without the need to write explicit, case-by-case routing logic or .htaccess files. It doesn't mess up the base path, so I don't need to do some magic when writing URLs. Moreover, it's straightforward. It's easy to see what's going on on the web pages, in the code and in the logs, because knowing a URL means immediately knowing which controller and action are involved (which is not the case with clever resource-mapping schemes).

View on HN

I think the most important part is whether you are respecting the semantics of the HTTP methods or not. A GET request should never delete something just because the URL says "method=delete".

This is a good example of what was meant, IMHO.

There are interesting cases, though, where multi-selecting items and then acting on them could require using a query parameter. "action=remove", "action=update", "action=validate" or something like that.

When dealing with singular resources - it's much easier to follow the HTTP methods and verbs but I'm still at a loss for how to handle multi-select cases where you can't represent 20,30,100+ items as a single resource in the URI.

This, is only in the case of a user's UI web experience and not an API - because I haven't figured this part out yet, I haven't supported batched actions like this in the API (haven't needed to, but it could be useful?).

> A GET request should never delete something just because the URL says "method=delete".

More generally, a GET must not alter application state. It can change a cache or a logfile (these are either implementation detail or irrelevant), but if there is any way for the user to see what was changed, then it does not belong in a GET[0].

[0] things like consumption quotas management are of course a different matter, but they're meta-data more than application state.

Except, as stated in a different comment, for things such as "unsubscribe" links.

No, I do not agree.

1. In a browser, the link would lead to a confirmation page POSTed to the server

2. In an API, there's no real sense in doing that, but it'd probably be a DELETE on the subscription resource.

What about from an email?

The link takes you to a page with a form where you can confirm by POSTing (to the user: submitting).

Hmm that could work for an unsubscribe page, since the user is motivated to make the second click. However, for an email with a sign up link or a subscription confirmation link having an extra step could reduce your conversion rate somewhat.

but OTOH semantics of GET allow e-mail servers to implement a link scanner that e.g. checks all linked pages for phishing.

That breaks (and likely is broken already in practice) when pages don't respect semantics of GET and unsubscribe/verify, etc. when page is merely displayed.

I can see the benefits in respecting request method semantics, but you can do that while using query strings, can't you? If someone calls http://example.com/?Bla.delete.1 with GET, you can just return 405 and do nothing.

I think that would technically fit the constraints, but it eliminates some of the benefits of the uniform interface if you have to POST to some URL instead of simply DELETEing the resource.

Again, you can have a URL like http://example.com?Articles.delete.1 and only accept DELETE requests. (However, I'm speaking about web applications, rather than services. This URL would be useless, since browsers don't support form-based DELETE and PUT for some reason. But that's beside the point.)

Point is, proper handling of GET, POST, PUT and DELETE is all about what you do when receiving those requests, not about the way you compose your URLs. At least that what it seems to be. If I'm wrong, I would very much like to hear why.

Again, you can have a URL like http://example.com?Articles.delete.1 and only accept DELETE requests.*

But you want to DELETE the actual article, not its deletion page ;) More specifically, if the client is reading an article in some URL, he shouldn't need to find out what's the special deletion URL. It leads to more brittle and less generic clients, with more work for the developer.

I think you're right if the goal is to abide by the REST constraints.

I see what you're saying about deleting the deletion page. It's an interesting point. Having separate URLs for GET, POST, PUT, DELETE, etc. on the same logical entity breaks the connection between those operations. However, I still don't see much added (practical) value in maintaining that connection, especially when it comes to websites (vs APIs). Even in perfect REST world, an article can be represented by a dozen URLs:

http://example.com/articles/3423423 http://example.com/reviews/fallout-new-vegas http://example.com/bob/submissions/articles/13

They might look different and only some of them might be DELETEable. (Or am I wrong here? I'm not entirely sure.) How that's different from treating http://example.com?Articles.delete.1 as a deletable representation of the same article? Both will affect many other pages on the website. You still need to understand what the request means to really know the consequences of sending it.

In short, I don't think there is anything particularly wrong with doing URLs the way I described.

Well, there is also something as "state". You don't want "method=delete" to work as POST either, unless the client is authorized. Same with GET. I don't see why POST would be better than GET really.

Theoretical reason: because that's what the HTTP spec says.

Practical reason: because browsers have prefetching systems that might GET resources without asking the user, which might be authorized anyway.

That's all fine and dandy until you change a class name, method name, parameter name.

Way to expose internal details about your implementation, though.

In practice, this is a non-issue. Instead of thinking of your routers as "the interface" and your controllers as "implementation" you can think of the controllers as the interface and everything else as "implementation". If you're concerned about arbitrarily changing class and methods names that are only used as interaction points for the user, you should be similarly concerned about arbitrarily changing routing logic.

So instead of having a router and controllers, you're just making the controllers do the work of the routers too.

I mean, you can, but why would you?

Reply on news.ycombinator.com