Hacker News Reader

Comment by Ethee | Hacker News Reader

Genuine question: How do you believe one should learn these semantics? This is more something I've been pondering myself recently, because I agree with you that the foundational knowledge for our work in any tech stack is usually the most important for understanding higher abstractions. But with so much to know it feels impossible to 'know it all' so to speak especially if you wear more than one specialized hat. Then beyond that even if you're only trying to learn just the foundations how do you know what those foundations are if you're not already inundated in that stack?

This is mostly just my personal ramblings, but I'd be curious other peoples viewpoints on this.

View on HN

I remember many years ago when I used to read print magazines about programming and web development.

One of those magazines told a story about a web site that had lost a lot of data. What had happened? Well, somehow they had this page that

1. Required no authentication at all, and

2. Was using links like

  <a href="/path/to/file?action=delete>Delete file</a>

And so the Google web crawler had come across this page and happily visited each and every one of those links.

That’s when I learned about the importance of using forms with POST requests for certain actions instead of using links that send GET requests.

And then some years later someone told me about this thing called HATEOAS and about RESTful APIs and that actually there are different HTTP verbs you can use other than just GET and POST. Like for example

  DELETE /path/to/file

As for your question about how someone is supposed to learn that these days?

Ideally whatever web development tutorials or courses or books they are using would at some point tell them about the different HTTP verbs that exists, and of how and when to use each of them, and crucially to tell them about bad consequences of using GET for anything that has side-effects like logging out a session or deleting a file.

This can be complex sometimes, but in case of HTTP methods specifically, it's hard to imagine how one can't know about this.

You learn HTML (and see a mention of "POST" method); or read HTTP primer (and see reference to methods) or open browser inspection window and see prominent "Method" column, or see the reference in some other place. You get interested and want to look it up - say wikipedia is often a good start [0] for generic part. And the second sentence of description says it all:

> GET: The GET method requests that the target resource transfer a representation of its state. GET requests should only retrieve data and should have no other effect.

[0] https://en.wikipedia.org/wiki/HTTP#Request_methods

MDN, no matter how highly rated, is still insanely underrated.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods

Also the many HTTP RFCs, this one in particular covers semantics:

https://www.rfc-editor.org/rfc/rfc9110.html

As the age old wisdom says... RTFM :P

HTTP is awesome, I'm in love with it. Beautiful piece of work.

IMO it's very understandable to not know about this sort of thing starting out. Everybody was new once, and it's much easier to get motivated to build cool stuff than to read about all the fine details of all of the technologies we're using. I say, go ahead and take the shortcuts and build some cool things in a maybe sloppy way as long as the traffic and stakes aren't too high. Then, once you've got something cool built, take some time every now and then to seek out and read about more of the details of some of the systems and tools you're using.

While it may not be quite the same answer you're looking for, I'd suggest the OWASP, and at least their top 10 for sure. Learning about SSRF may not have stopped this behavior (it's coming from the authenticated browser), but if you're doing CSRF checks you won't get logged out by random links on other peoples sites, and that whatever logged you out was a legitimate action.

Personally, I think it comes from experience and learning. I read the comment and an old HN story popped into my head.

That was where I "learnt" side effects of not using verbs properly. It stuck to me from then.

https://news.ycombinator.com/item?id=16964907

It requires slowing down. Unheard of.

Exactly. And ditching the "move fast and break things" mindset. Learn your craft and embrace the learning process. Always be curious about how the stuff below your layer works, fundamentally. Recurse on searching for the seminal works that defined those layers.

This seems appropriately relevant today: https://news.ycombinator.com/item?id=41208627

We (the industry) have built up so many layers upon layers and frameworks designed to make things easier that it just seems to attract newcomers to software engineering with this mindset that all it takes is to start with the sample-app for a high level framework, hack on it with trial and error until it does something they want, and then take to social media with proclamations of "Look! I built a thing! You can hire me to build your thing now!"

A book is always a good start.

The RFCs are often fairly well written and not so hard to digest.

Follow the Ruby on Rails getting started guide and build a toy Rails web app. It has conventional http semantics baked in, you'll learn a lot.

Reply on news.ycombinator.com