Hacker News Reader

Comment by montroser | Hacker News Reader

This seems reasonable, but unlikely to happen. GET is already pretty much sufficient, especially given that clients generally support megabytes worth of query strings in these modern times. If we're doing this though, I'll cast my vote for naming it more semantically as QUERY, and forgoing whatever little WebDAV compatibility would be had otherwise.

View on HN

Funny you should say that:

https://httpwg.org/http-extensions/draft-ietf-httpbis-safe-m...

I understand the benefits of QUERY over GET because GET is expected to return a resource in the response. Why not just use POST though? Send a post message to a server asking to conduct a search and sending the results of that query in the response?

The biggest issue I've personally experienced is semantics when wrapping your head a design or debugging a service you aren't familiar with.

"POST" has come to imply a "write" operation, and mixing up the the reads and writes of a system leads to cognitive dissonance.

QUERY is the one missing method to cover all reasonable combinations of safe/idempotent/neither and whether (if safety or idempotency applies) a body needs taken into account to identify a semantically identical request.

Not idempotent: POST

idempotent/not safe: PUT (body matters), DELETE (no body)

safe: QUERY (body matters)/GET (no body)

That’s why QUERY is needed. POST is not a good substitute.

QUERY would be more compatible with WebDAV as the would be no confusion. The relevant compatibility is with middle boxes like proxy servers that mostly already forward SEARCH but would block QUERY.

I’ve, amazingly, managed to hit the arbitrary megabyte limit in real production software.

Same, that's configurable though, and 1mb sounds like nginx. It's a lot higher on many other web servers including Apache.

Middle boxes can arbitrarily limit the request URL size in certain cases.

Sure, but in the times of encrypted traffic, the only middle boxes capable of limiting the query should be ones explicitly added by the service owner.

In an enterprise setting you can just roll out your own root certificate to every machine's trust store, and have your middle box MitM all traffic with the help of that.