When a user signs up to a web app, they often get a confirmation email. This email will contain a link. Once the user clicks the link, the app confirms the user's account as correctly associated with said email, perhaps by changing a
confirmed field on the
user document from
- The endpoint changes data (ei:
true) so this action isn't safe*.
- The link is a GET request.
Don't these two facts violate HTTP standards? GET requests are supposed to be safe. So
PATCH seems more appropriate for changing the
confirmed field. However, there is no way to make a link in an email a
How do software engineers handle this inconsistency? Is it just a violation that's accepted? Or is there a correct way to implement this so that we don't violate HTTP standards.
*An HTTP method is safe if it doesn't alter the state of the server. source