Questions tagged [http]
HyperText Transfer Protocol - a textual system for representing web requests and replies.
382
questions
226
votes
3
answers
248k
views
Why doesn't HTTP have POST redirect?
HTTP redirects are done via HTTP codes 301, and 302 (maybe other codes also) and a header field known as "Location" which has the address of the new place to go. However, browsers always send a "GET" ...
- 18.2k
137
votes
6
answers
76k
views
Why shouldn't a GET request change data on the server?
All over the internet, I see the following advice:
A GET should never change data on the server- use a POST request for that
What is the basis for this idea?
If I make a php service which ...
- 2,534
123
votes
8
answers
204k
views
RESTful API. Should I be returning the object that was created / updated?
I'm designing a RESTful web service using WebApi and was wondering what HTTP responses and response bodies to return when updating / creating objects.
For example I can use the POST method to send ...
- 1,333
114
votes
5
answers
86k
views
Should I return an HTTP 400 (Bad Request) status if a parameter is syntactically correct, but violates a business rule?
Say that I have a REST endpoint that takes an integer as a parameter:
/makeWaffles?numberOfWaffles=3
In this case, I want the number to be positive because I can't make a negative number of waffles (...
- 2,708
94
votes
4
answers
98k
views
What belongs in an HTTP request header vs the request body?
I'm working on a set of web services for a mobile client, and the requirements call for a unique device id to be included with all requests, to be stored in certain requests, and used to filter ...
- 6,647
90
votes
8
answers
62k
views
What HTTP status code to return if multiple actions finish with different statuses?
I am building an API where the user can ask the server to perform multiple actions in one HTTP request. The result is returned as a JSON array, with one entry per action.
Each of these actions might ...
- 1,351
88
votes
6
answers
74k
views
HTTP Status Code for "Still Processing"
I'm building a RESTful API that supports queuing long-running tasks for eventual handling.
The typical workflow for this API would be:
User fills in form
Client posts data to API
API returns 202 ...
- 1,085
84
votes
4
answers
26k
views
Should I use HTTP status codes to describe application level events
Several servers I have dealt with will return HTTP 200 for requests that the client ought to consider a failure, with something like 'success : false' in the body.
This does not seem like a proper ...
- 951
79
votes
3
answers
55k
views
Trailing slash in RESTful API
I have been having a debate about what to do with a trailing slash in a RESTful API.
Lets say I have a resource called dogs and subordinate resources for individual dogs. We can therefore do the ...
- 3,125
75
votes
9
answers
148k
views
When to use HTTP status code 404 in an API
I am working on a project and after arguing with people at work for about more than a hour. I decided to know what people on stack-exchange might say.
We're writing an API for a system, there is a ...
- 1,644
72
votes
4
answers
29k
views
Why PATCH method is not idempotent?
I was wondering about this.
Suppose I have a user resource with id and name fields.
If I want to update a field I could just do a PATCH request to the resource like this
PATCH /users/42
{"name&...
- 972
72
votes
2
answers
58k
views
How should a REST API handle PUT requests to partially-modifiable resources?
Suppose a REST API, in response to a HTTP GET request, returns some additional data in a sub-object owner:
{
id: 'xyz',
... some other data ...
owner: {
name: 'Jo Bloggs',
role: '...
- 1,263
65
votes
5
answers
9k
views
What does HATEOAS offer for discoverability and decoupling besides ability to change your URL structure more or less freely?
Lately I've been reading about Hypermedia as the Engine of Application State (HATEOAS), the constraint that is claimed to make a web API "truly RESTful". It boils down to basically including links ...
- 1,473
52
votes
10
answers
21k
views
What should be the http status code for "Service not available in your area" error?
Our service is in 5 cities right now. If someone tries to call our service API from any other city, we want to throw this error Service not available in your area.
The question is, what is the ...
- 865
47
votes
2
answers
33k
views
Suggested HTTP REST status code for 'request limit reached'
I'm putting together a spec for a REST service, part of which will incorporate the ability to throttle users service-wide and on groups of, or on individual, resources. Equally, time-outs for these ...
- 901
45
votes
3
answers
24k
views
Are there any problems with implementing custom HTTP methods?
We have a URL in the following format
/instance/{instanceType}/{instanceId}
You can call it with the standard HTTP methods: POST, GET, DELETE, PUT. However, there are a few more actions that we ...
- 826
44
votes
3
answers
30k
views
Recommended HTTP status code for "plan limit exceeded" response
I'm designing a REST API for a project where users are always on one of several "plans" - each plan defines some resource limits, such as the max number of users an account may have or the max number ...
- 591
44
votes
4
answers
18k
views
REST - Tradeoffs between content negotiation via Accept header versus extensions
I'm working through designing a RESTful API. We know we want to return JSON and XML for any given resource. I had been thinking we would do something like this:
GET /api/something?param1=value1
...
- 1,715
43
votes
6
answers
87k
views
Should an HTTP API always return a body?
Is there some sort of standard regarding HTTP API responses?
After reading this discourse thread I started to wonder. We are developing our public HTTP JSON API at my work, and we do not return ...
- 1,749
32
votes
5
answers
12k
views
How do web servers enforce the same-origin policy?
I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
- 899
32
votes
3
answers
82k
views
Should I return a 204 or a 404 response when a resource is not found?
I am developing a simple RESTful service for tournaments and schedules. When a tournament is created through a POST request containing a JSON body, the tournament is inserted in a BiMap, declared as ...
- 2,236
28
votes
6
answers
4k
views
What to call an HTTP API that is not RESTful? [closed]
What would you call an API that is HTTP-based, uses URI to name resources and HTTP verbs (PUT, POST, DELETE, GET...) to manipulate those resources?
According to Roy Fielding's complaints it is not ...
- 689
28
votes
2
answers
22k
views
How to write a HTTP server?
As the title says, I would like to write a HTTP server. My question is this, how do I do this? I know this sounds VERY general and too "high level", but there is a method to my madness. An answer to ...
- 391
27
votes
2
answers
19k
views
Should I make up my own HTTP status codes? (a la Twitter 420: Enhance Your Calm)
I'm currently implementing an HTTP API, my first ever.
I've been spending a lot of time looking at the Wikipedia page for HTTP status codes, because I'm determined to implement the right codes for ...
- 383
26
votes
5
answers
12k
views
Why can't we use IP address instead of cookies in identifying the client in servlets?
I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit ...
- 1,220
25
votes
2
answers
11k
views
Levels of user permissions in a RESTful API
Let's say I have a company that ranks the cutest cats on the internet.
I offer a resource at /cats/ which provides users with the latest, cutest adorable cats.
Users can either get just the top 3 cats ...
- 5,167
25
votes
5
answers
4k
views
Providing friendly URLs for a website vs. realities of database IDs
We have a database of resources, be they products, blog posts or something. We need to design a URL scheme to address them, for the public website.
Here are two examples that are database ID bound:
...
- 719
22
votes
6
answers
3k
views
REST endpoint to show a preview before POSTing
I'm designing a new web application which is powered by a REST backend and HTML+JS frontend.
There's one POST method on it to change one entity (let's call Config), that has several side effects in ...
- 373
21
votes
2
answers
18k
views
Should I store my user claims in the JWT token?
I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure.
I cannot makeup my mind as to whether ...
- 313
20
votes
4
answers
42k
views
What does it mean to "expose" something?
So I am working on creating a Google App Engine Application, and I've come across the term "expose" a number of times, e.g. "your first app can expose objects using an HTTP based API" and "expose this ...
- 389
19
votes
1
answer
17k
views
RESTful API and i18n: how to design the response?
We are designing a RESTful API that is mainly intended to meet the needs of a single client. Because of its very particular circumstances, this client has to make as few requests as possible.
The ...
- 301
18
votes
3
answers
31k
views
Handling token renewal / session expiration in a RESTful API
I'm building a RESTful API that uses JWT tokens for user authentication (issued by a login endpoint and sent in all headers afterwards), and the tokens need to be refreshed after a fixed amount of ...
- 345
18
votes
4
answers
16k
views
Is it a good idea to merge multiple HTTP requests to save bandwidth?
I am preparing a single page application that would be sometimes used over slow mobile connection. Some of its part are quite heavy in terms of API requests (fetching ten different resources for a new ...
- 422
18
votes
1
answer
3k
views
Is progressive HTTP download a viable alternative to HLS/DASH/RTMP for providing live video?
I'm working on a website that needs to stream live video to users, and as such I've had to get my head around the sorry state of current browser-based video-streaming technology. The most popular ...
- 1,250
17
votes
2
answers
9k
views
Should I specify the userId in the REST URL structure?
Basically, one feature of my app is to retrieve the logged user's friends.
Actually, I hesitate between both kind of endpoints:
GET /api/users/friends
GET /api/users/:userId/friends
Using 1, ...
- 3,888
16
votes
6
answers
4k
views
What reasons are there AGAINST using only POST HTTP verb in an API?
I am researching before starting to work on an API for a web-service I am building. The goal is to be very quick and easy to adapt and use for other developers but fairly hidden for clients using a ...
- 301
15
votes
12
answers
3k
views
Understanding the stateless internet [closed]
I'm transitioning from being a desktop developer to a web developer, and I'm having trouble understanding why HTTP is stateless. What are the reasons for it? What are some ways a desktop developer ...
- 11.1k
15
votes
4
answers
5k
views
Why is the Apache HTTP Server so complex?
The Apache HTTP server is a fairly large project—much larger than, say, lighthttp or nginx or certainly the "simple HTTP servers" you see floating around in C/C++ tutorials.
What is the extra code ...
- 253
15
votes
5
answers
10k
views
Why doesn't the HTML\DOM specification allow hyperlinks to set an accept header?
The purpose of the Accept header from the client is to tell the server what kind of data it will accept as a response to its request. We can set this header in asynchronous HTTP calls in Javascript, ...
- 6,046
14
votes
2
answers
21k
views
Comparing TCP/IP applications vs HTTP applications [closed]
I'm interested in developing a large-scale user-facing website that is written in Java.
As for design, I'm thinking of developing independent, modular services that can act as data providers to my ...
- 1,113
14
votes
4
answers
3k
views
Why is HTML/Javascript minification beneficial
Why is HTML/Javascript minification beneficial when the HTTP protocol already supports gzip data compression?
I realize that Javascript/HTML minification has the potential to significantly reduce ...
- 2,495
14
votes
1
answer
7k
views
Why do some websites showing 0 bytes in Chrome's developer tools
I am doing a page speed optimization for my website and studying how other websites do it. I noticed that some websites such as as Facebook or Ringgitplus show 0 bytes for some of their resources in ...
- 433
13
votes
3
answers
39k
views
Is it safe to transmit access tokens via HTTP headers?
It's the first RESTful web service and I am concerned about security issues. Is it safe to transmit my access token via HTTP headers? For example:
POST /v1/i/resource HTTP/1.1
Content-Type: ...
- 233
13
votes
2
answers
23k
views
Implementing the command pattern in a RESTful API
I'm in the process of designing an HTTP API, hopefully making it as RESTful as possible.
There are some actions which functionality spreads over a few resources, and sometime needs to be undone.
I ...
- 1,339
12
votes
5
answers
15k
views
Why don't HTTP headers include device resolution, pixel density, etc.?
I'm currently developing a responsive website with CSS media queries. It would be much easier if the server returned a different HTML/CSS for each viewport.
I was wondering why couldn't the client ...
- 275
11
votes
4
answers
3k
views
What should I do when optimistic locking doesn't work?
I have this following scenario:
A user makes a GET request to /projects/1 and receives an ETag.
The user makes a PUT request to /projects/1 with the ETag from step #1.
The user makes another PUT ...
- 163
11
votes
1
answer
8k
views
Use 404 or 200 when null result (REST) [duplicate]
Let's assume we have an Entity
{
"id": 1
"inProgress": true,
}
We have endpoints:
/api/v1/entities/ for fetching all entities,
/api/v1/entities/1 for fetching entity with id = 1
/api/v1/...
- 227
11
votes
5
answers
7k
views
Applying RESTful design to an entire website?
This all may come across very newbish, but I'm trying to wrap my head around designing a website that is thoroughly RESTful. I understand applying RESTful design to things like Users, Photos, Blog ...
- 2,667
11
votes
2
answers
12k
views
REST: How to determine transient exceptions?
As I try to deal with the possibility of failure when I invoke RESTful endpoints or in general any HTTP endpoint I've been wondering if there is any standard or pattern in the HTTP specification or in ...
- 2,656
11
votes
1
answer
3k
views
REST API rule about tunneling
Just read this in the REST API Rulebook: GET and POST must not be used to tunnel other request methods.
Tunneling refers to any abuse of HTTP that masks or misrepresents a message’s intent and ...
- 1,508