Questions tagged [http]
HyperText Transfer Protocol - a textual system for representing web requests and replies.
382
questions
226
votes
3
answers
248k
views
Why doesn't HTTP have POST redirect?
HTTP redirects are done via HTTP codes 301, and 302 (maybe other codes also) and a header field known as "Location" which has the address of the new place to go. However, browsers always send a "GET" ...
137
votes
6
answers
76k
views
Why shouldn't a GET request change data on the server?
All over the internet, I see the following advice:
A GET should never change data on the server- use a POST request for that
What is the basis for this idea?
If I make a php service which ...
123
votes
8
answers
204k
views
RESTful API. Should I be returning the object that was created / updated?
I'm designing a RESTful web service using WebApi and was wondering what HTTP responses and response bodies to return when updating / creating objects.
For example I can use the POST method to send ...
114
votes
5
answers
86k
views
Should I return an HTTP 400 (Bad Request) status if a parameter is syntactically correct, but violates a business rule?
Say that I have a REST endpoint that takes an integer as a parameter:
/makeWaffles?numberOfWaffles=3
In this case, I want the number to be positive because I can't make a negative number of waffles (...
94
votes
4
answers
98k
views
What belongs in an HTTP request header vs the request body?
I'm working on a set of web services for a mobile client, and the requirements call for a unique device id to be included with all requests, to be stored in certain requests, and used to filter ...
90
votes
8
answers
62k
views
What HTTP status code to return if multiple actions finish with different statuses?
I am building an API where the user can ask the server to perform multiple actions in one HTTP request. The result is returned as a JSON array, with one entry per action.
Each of these actions might ...
88
votes
6
answers
74k
views
HTTP Status Code for "Still Processing"
I'm building a RESTful API that supports queuing long-running tasks for eventual handling.
The typical workflow for this API would be:
User fills in form
Client posts data to API
API returns 202 ...
84
votes
4
answers
26k
views
Should I use HTTP status codes to describe application level events
Several servers I have dealt with will return HTTP 200 for requests that the client ought to consider a failure, with something like 'success : false' in the body.
This does not seem like a proper ...
79
votes
3
answers
55k
views
Trailing slash in RESTful API
I have been having a debate about what to do with a trailing slash in a RESTful API.
Lets say I have a resource called dogs and subordinate resources for individual dogs. We can therefore do the ...
75
votes
9
answers
148k
views
When to use HTTP status code 404 in an API
I am working on a project and after arguing with people at work for about more than a hour. I decided to know what people on stack-exchange might say.
We're writing an API for a system, there is a ...
72
votes
4
answers
29k
views
Why PATCH method is not idempotent?
I was wondering about this.
Suppose I have a user resource with id and name fields.
If I want to update a field I could just do a PATCH request to the resource like this
PATCH /users/42
{"name&...
72
votes
2
answers
58k
views
How should a REST API handle PUT requests to partially-modifiable resources?
Suppose a REST API, in response to a HTTP GET request, returns some additional data in a sub-object owner:
{
id: 'xyz',
... some other data ...
owner: {
name: 'Jo Bloggs',
role: '...
65
votes
5
answers
9k
views
What does HATEOAS offer for discoverability and decoupling besides ability to change your URL structure more or less freely?
Lately I've been reading about Hypermedia as the Engine of Application State (HATEOAS), the constraint that is claimed to make a web API "truly RESTful". It boils down to basically including links ...
52
votes
10
answers
21k
views
What should be the http status code for "Service not available in your area" error?
Our service is in 5 cities right now. If someone tries to call our service API from any other city, we want to throw this error Service not available in your area.
The question is, what is the ...
47
votes
2
answers
33k
views
Suggested HTTP REST status code for 'request limit reached'
I'm putting together a spec for a REST service, part of which will incorporate the ability to throttle users service-wide and on groups of, or on individual, resources. Equally, time-outs for these ...
45
votes
3
answers
24k
views
Are there any problems with implementing custom HTTP methods?
We have a URL in the following format
/instance/{instanceType}/{instanceId}
You can call it with the standard HTTP methods: POST, GET, DELETE, PUT. However, there are a few more actions that we ...
44
votes
3
answers
30k
views
Recommended HTTP status code for "plan limit exceeded" response
I'm designing a REST API for a project where users are always on one of several "plans" - each plan defines some resource limits, such as the max number of users an account may have or the max number ...
44
votes
4
answers
18k
views
REST - Tradeoffs between content negotiation via Accept header versus extensions
I'm working through designing a RESTful API. We know we want to return JSON and XML for any given resource. I had been thinking we would do something like this:
GET /api/something?param1=value1
...
43
votes
6
answers
87k
views
Should an HTTP API always return a body?
Is there some sort of standard regarding HTTP API responses?
After reading this discourse thread I started to wonder. We are developing our public HTTP JSON API at my work, and we do not return ...
32
votes
5
answers
12k
views
How do web servers enforce the same-origin policy?
I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
32
votes
3
answers
82k
views
Should I return a 204 or a 404 response when a resource is not found?
I am developing a simple RESTful service for tournaments and schedules. When a tournament is created through a POST request containing a JSON body, the tournament is inserted in a BiMap, declared as ...
28
votes
6
answers
4k
views
What to call an HTTP API that is not RESTful? [closed]
What would you call an API that is HTTP-based, uses URI to name resources and HTTP verbs (PUT, POST, DELETE, GET...) to manipulate those resources?
According to Roy Fielding's complaints it is not ...
28
votes
2
answers
22k
views
How to write a HTTP server?
As the title says, I would like to write a HTTP server. My question is this, how do I do this? I know this sounds VERY general and too "high level", but there is a method to my madness. An answer to ...
27
votes
2
answers
19k
views
Should I make up my own HTTP status codes? (a la Twitter 420: Enhance Your Calm)
I'm currently implementing an HTTP API, my first ever.
I've been spending a lot of time looking at the Wikipedia page for HTTP status codes, because I'm determined to implement the right codes for ...
26
votes
5
answers
12k
views
Why can't we use IP address instead of cookies in identifying the client in servlets?
I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit ...
25
votes
2
answers
11k
views
Levels of user permissions in a RESTful API
Let's say I have a company that ranks the cutest cats on the internet.
I offer a resource at /cats/ which provides users with the latest, cutest adorable cats.
Users can either get just the top 3 cats ...
25
votes
5
answers
4k
views
Providing friendly URLs for a website vs. realities of database IDs
We have a database of resources, be they products, blog posts or something. We need to design a URL scheme to address them, for the public website.
Here are two examples that are database ID bound:
...
22
votes
6
answers
3k
views
REST endpoint to show a preview before POSTing
I'm designing a new web application which is powered by a REST backend and HTML+JS frontend.
There's one POST method on it to change one entity (let's call Config), that has several side effects in ...
21
votes
2
answers
18k
views
Should I store my user claims in the JWT token?
I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure.
I cannot makeup my mind as to whether ...
20
votes
4
answers
42k
views
What does it mean to "expose" something?
So I am working on creating a Google App Engine Application, and I've come across the term "expose" a number of times, e.g. "your first app can expose objects using an HTTP based API" and "expose this ...
19
votes
1
answer
17k
views
RESTful API and i18n: how to design the response?
We are designing a RESTful API that is mainly intended to meet the needs of a single client. Because of its very particular circumstances, this client has to make as few requests as possible.
The ...
18
votes
3
answers
31k
views
Handling token renewal / session expiration in a RESTful API
I'm building a RESTful API that uses JWT tokens for user authentication (issued by a login endpoint and sent in all headers afterwards), and the tokens need to be refreshed after a fixed amount of ...
18
votes
4
answers
16k
views
Is it a good idea to merge multiple HTTP requests to save bandwidth?
I am preparing a single page application that would be sometimes used over slow mobile connection. Some of its part are quite heavy in terms of API requests (fetching ten different resources for a new ...
18
votes
1
answer
3k
views
Is progressive HTTP download a viable alternative to HLS/DASH/RTMP for providing live video?
I'm working on a website that needs to stream live video to users, and as such I've had to get my head around the sorry state of current browser-based video-streaming technology. The most popular ...
17
votes
2
answers
9k
views
Should I specify the userId in the REST URL structure?
Basically, one feature of my app is to retrieve the logged user's friends.
Actually, I hesitate between both kind of endpoints:
GET /api/users/friends
GET /api/users/:userId/friends
Using 1, ...
16
votes
6
answers
4k
views
What reasons are there AGAINST using only POST HTTP verb in an API?
I am researching before starting to work on an API for a web-service I am building. The goal is to be very quick and easy to adapt and use for other developers but fairly hidden for clients using a ...
15
votes
12
answers
3k
views
Understanding the stateless internet [closed]
I'm transitioning from being a desktop developer to a web developer, and I'm having trouble understanding why HTTP is stateless. What are the reasons for it? What are some ways a desktop developer ...
15
votes
4
answers
5k
views
Why is the Apache HTTP Server so complex?
The Apache HTTP server is a fairly large project—much larger than, say, lighthttp or nginx or certainly the "simple HTTP servers" you see floating around in C/C++ tutorials.
What is the extra code ...
15
votes
5
answers
10k
views
Why doesn't the HTML\DOM specification allow hyperlinks to set an accept header?
The purpose of the Accept header from the client is to tell the server what kind of data it will accept as a response to its request. We can set this header in asynchronous HTTP calls in Javascript, ...
14
votes
2
answers
21k
views
Comparing TCP/IP applications vs HTTP applications [closed]
I'm interested in developing a large-scale user-facing website that is written in Java.
As for design, I'm thinking of developing independent, modular services that can act as data providers to my ...
14
votes
4
answers
3k
views
Why is HTML/Javascript minification beneficial
Why is HTML/Javascript minification beneficial when the HTTP protocol already supports gzip data compression?
I realize that Javascript/HTML minification has the potential to significantly reduce ...
14
votes
1
answer
7k
views
Why do some websites showing 0 bytes in Chrome's developer tools
I am doing a page speed optimization for my website and studying how other websites do it. I noticed that some websites such as as Facebook or Ringgitplus show 0 bytes for some of their resources in ...
13
votes
3
answers
39k
views
Is it safe to transmit access tokens via HTTP headers?
It's the first RESTful web service and I am concerned about security issues. Is it safe to transmit my access token via HTTP headers? For example:
POST /v1/i/resource HTTP/1.1
Content-Type: ...
13
votes
2
answers
23k
views
Implementing the command pattern in a RESTful API
I'm in the process of designing an HTTP API, hopefully making it as RESTful as possible.
There are some actions which functionality spreads over a few resources, and sometime needs to be undone.
I ...
12
votes
5
answers
15k
views
Why don't HTTP headers include device resolution, pixel density, etc.?
I'm currently developing a responsive website with CSS media queries. It would be much easier if the server returned a different HTML/CSS for each viewport.
I was wondering why couldn't the client ...
11
votes
4
answers
3k
views
What should I do when optimistic locking doesn't work?
I have this following scenario:
A user makes a GET request to /projects/1 and receives an ETag.
The user makes a PUT request to /projects/1 with the ETag from step #1.
The user makes another PUT ...
11
votes
1
answer
8k
views
Use 404 or 200 when null result (REST) [duplicate]
Let's assume we have an Entity
{
"id": 1
"inProgress": true,
}
We have endpoints:
/api/v1/entities/ for fetching all entities,
/api/v1/entities/1 for fetching entity with id = 1
/api/v1/...
11
votes
5
answers
7k
views
Applying RESTful design to an entire website?
This all may come across very newbish, but I'm trying to wrap my head around designing a website that is thoroughly RESTful. I understand applying RESTful design to things like Users, Photos, Blog ...
11
votes
2
answers
12k
views
REST: How to determine transient exceptions?
As I try to deal with the possibility of failure when I invoke RESTful endpoints or in general any HTTP endpoint I've been wondering if there is any standard or pattern in the HTTP specification or in ...
11
votes
1
answer
3k
views
REST API rule about tunneling
Just read this in the REST API Rulebook: GET and POST must not be used to tunnel other request methods.
Tunneling refers to any abuse of HTTP that masks or misrepresents a message’s intent and ...