logoalt Hacker News

chroniclertoday at 2:15 AM7 repliesview on HN

Making GET requests have bodies as the norm would also handle this


Replies

platzhirschtoday at 2:18 AM

I might be misunderstanding something, but it seems the issue isn't really about whether GET can technically carry a body. The deeper concern is that HTTP methods have specific meanings, and mixing those signals can causes confusion and it's nice to have this semantic separation.

show 2 replies
badbottytoday at 2:26 AM

GET is a keep things simple stupid approach to caching. The URL is the cache key plus any headers touched by the vary header. Adding the requirement to vary on the body and understand the body content semantics brings in a whole lot of complexity that GET avoids.

bhawkstoday at 7:19 AM

That ship sailed decades ago. Too much software and middleware expects GET to not have a body and who knows how itll break when you start sending one. Obviously you can do it today and it might work and then randomly break when the code between client and server changes.

Adding a new http method is the only way to support something like this safely. If something in between doesn't know what to do with QUERY it can just respond with a 501.

Fun fact - GET and HEAD are the only required methods one needs to implement to be an http server. It is a pretty low bar :)

show 1 reply
locknitpickertoday at 10:40 AM

> Making GET requests have bodies as the norm would also handle this

The RFC is pretty clear that no participant in a HTTP request is expected to even allow a GET request through. RFC 9110 even states quite clearly that it's even a potential request smuggling attack. Some major cloud providers provide API Gateway implementations that outright strip request bodies from GET requests.

I think you are missing the whole point of proposing a new HTTP verb. Changing the semantics of a GET request is not an option because of both the security risks it presents and the fact that the infrastructure of the whole internet either is designed to reject these requests or outright breaks. See how GET requests are cached and how cache implementations don't discriminate GET requests based on it's request body.

vbezhenartoday at 10:52 AM

Yeah, it works already, this RFC makes no sense.

vlovich123today at 3:14 AM

I suspect the challenge would be all the middleware that assumes that get never had a body.

ashu1461today at 3:23 AM

or get requests with query params already handles this in majority of the cases, unless the query size is too big (which ideally should not be the case since in the end it is a get request)