Just read this in the REST API Rulebook: GET and POST must not be used to tunnel other request methods.

Tunneling refers to any abuse of HTTP that masks or misrepresents a message’s intent and undermines the protocol’s transparency. A REST API must not compromise its design by misusing HTTP’s request methods in an effort to accommodate clients with limited HTTP vocabulary. Always make proper use of the HTTP methods as specified by the rules in this section. [highlights by me]

But then a lot of frameworks use tunneling to expose REST interfaces via HTML forms, since <form> knows only about GET and POST. My most recent example is a MethodRewriteMiddleware for flask (submitted by the author of the framework): http://flask.pocoo.org/snippets/38/.

Any ways to comply to the "Rule" without hacks or add-ons in web frameworks?


1 Answer 1


No, there isn't. So if you need to, break the rule anyway.

I don't know what the big deal is. Protocols encapsulate other protocols all the time. TCP/IP for example has four layers of such abstraction.

Of course, the better path is for clients to get with the program and support the HTTP verbs properly. But it's not a perfect world.

  • Thanks, well everybody is doing it anyway (and other protocols do it by design, as you mention it). I just was a bit surprised to find the "rule" written down so clearly.
    – miku
    Oct 25, 2012 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.