Questions tagged [http]

HyperText Transfer Protocol - a textual system for representing web requests and replies.

Filter by
Sorted by
Tagged with
72
votes
4answers
19k views

Should I use HTTP status codes to describe application level events

Several servers I have dealt with will return HTTP 200 for requests that the client ought to consider a failure, with something like 'success : false' in the body. This does not seem like a proper ...
106
votes
5answers
68k views

Should I return an HTTP 400 (Bad Request) status if a parameter is syntactically correct, but violates a business rule?

Say that I have a REST endpoint that takes an integer as a parameter: /makeWaffles?numberOfWaffles=3 In this case, I want the number to be positive because I can't make a negative number of waffles (...
64
votes
5answers
9k views

What does HATEOAS offer for discoverability and decoupling besides ability to change your URL structure more or less freely?

Lately I've been reading about Hypermedia as the Engine of Application State (HATEOAS), the constraint that is claimed to make a web API "truly RESTful". It boils down to basically including links ...
129
votes
6answers
64k views

Why shouldn't a GET request change data on the server?

All over the internet, I see the following advice: A GET should never change data on the server- use a POST request for that What is the basis for this idea? If I make a php service which ...
69
votes
9answers
126k views

When to use HTTP status code 404 in an API

I am working on a project and after arguing with people at work for about more than a hour. I decided to know what people on stack-exchange might say. We're writing an API for a system, there is a ...
61
votes
2answers
49k views

How should a REST API handle PUT requests to partially-modifiable resources?

Suppose a REST API, in response to a HTTP GET request, returns some additional data in a sub-object owner: { id: 'xyz', ... some other data ... owner: { name: 'Jo Bloggs', role: '...
7
votes
3answers
4k views

How to handle business rules with a REST API?

I have a REST API to manage a booking system I'm searching how to manage this situation : A customer can book a time slot : A TimeSlot resource is created and linked to a Person resource. In order to ...
3
votes
2answers
2k views

How should I provide detailed information about an error, if not through HTTP status codes?

This question comes from here. I believe it deserves to be on its own instead of being lost in a long question with multiple points. I'm building an API and find myself limited by HTTP error codes. ...
74
votes
4answers
74k views

What belongs in an HTTP request header vs the request body?

I'm working on a set of web services for a mobile client, and the requirements call for a unique device id to be included with all requests, to be stored in certain requests, and used to filter ...
71
votes
4answers
50k views

HTTP Status Code for "Still Processing"

I'm building a RESTful API that supports queuing long-running tasks for eventual handling. The typical workflow for this API would be: User fills in form Client posts data to API API returns 202 ...
42
votes
4answers
18k views

REST - Tradeoffs between content negotiation via Accept header versus extensions

I'm working through designing a RESTful API. We know we want to return JSON and XML for any given resource. I had been thinking we would do something like this: GET /api/something?param1=value1 ...
81
votes
8answers
48k views

What HTTP status code to return if multiple actions finish with different statuses?

I am building an API where the user can ask the server to perform multiple actions in one HTTP request. The result is returned as a JSON array, with one entry per action. Each of these actions might ...
25
votes
3answers
57k views

Should I return a 204 or a 404 response when a resource is not found?

I am developing a simple RESTful service for tournaments and schedules. When a tournament is created through a POST request containing a JSON body, the tournament is inserted in a BiMap, declared as ...
28
votes
5answers
10k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
15
votes
12answers
3k views

Understanding the stateless internet [closed]

I'm transitioning from being a desktop developer to a web developer, and I'm having trouble understanding why HTTP is stateless. What are the reasons for it? What are some ways a desktop developer ...
26
votes
5answers
11k views

Why can't we use IP address instead of cookies in identifying the client in servlets?

I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit ...
11
votes
5answers
7k views

Applying RESTful design to an entire website?

This all may come across very newbish, but I'm trying to wrap my head around designing a website that is thoroughly RESTful. I understand applying RESTful design to things like Users, Photos, Blog ...
8
votes
3answers
10k views

POST and PUT requests – is it just the convention?

I've read quite a few articles on the difference between POST and PUT and in when the two should be used. But there are still few things confusing me ( hopefully questions will make some sense ): 1) ...
12
votes
5answers
2k views

What reasons are there AGAINST using only POST HTTP verb in an API?

I am researching before starting to work on an API for a web-service I am building. The goal is to be very quick and easy to adapt and use for other developers but fairly hidden for clients using a ...
9
votes
1answer
4k views

Use 404 or 200 when null result (REST) [duplicate]

Let's assume we have an Entity { "id": 1 "inProgress": true, } We have endpoints: /api/v1/entities/ for fetching all entities, /api/v1/entities/1 for fetching entity with id = 1 /api/v1/...
4
votes
1answer
3k views

Is HTTP 426 acceptable for "Your request should have been HTTPS"

I have an HTTP serving an API which works either anonymously or with a secret key in a header, like so: GET /profile?authenticationKey Authorization: 1234567890 I want to reject any request coming ...
2
votes
2answers
1k views

Should I use HTTP search

I am working on a web api and I am curios about the HTTP SEARCH verb and how you should use it. My first approach was, well you could use it surely for a search. But asp.net WebApi doesn't support ...
2
votes
4answers
651 views

What does "side-effect" mean in the context of "Idempotent HTTP methods may not have side-effects when repeated multiple times"?

HTTP has safe and idempotent HTTP-methods. Idempotence in HTTP is not exactly the same as idempotence in mathematics, the definition states: Methods can also have the property of "idempotence&...
2
votes
1answer
413 views

How to structure your URIs?

I am making a web UI and an HTTP API for editing JSON documents in collaboration (role and versioning system). There are several types of JSON documents. Each type is described by a JSON schema, let ...
1
vote
4answers
106 views

Replace Rest verbs with custom object to drive resource operations

One of my clients has a Restful API on which I'm supposed to work on that only exposes two verbs: POST and GET. The POST endpoint is used in lieu of the standard Rest verbs: PUT, DELETE, PATCH. The ...
1
vote
1answer
1k views

Spring4 error handling and HTTP status codes returned for REST services

We are writing Spring4 based REST services and had a question about returned HTTP status codes. It looks like the generally accepted approach is to let the app server or web server container handle ...
0
votes
2answers
134 views

A command as the intended effect of POST versus as the side effect of PUT

The intended effect (semantics) of the POST method is resource specific, e.g. executing a command with arguments: POST /command HTTP/1.1 {"parameter-1": "argument-1", "...
-4
votes
2answers
114 views

Does the HTTP specification fully define the semantics of request methods?

I see two possible interpretations of the semantics of request methods defined in the HTTP specification RFC 7231: The intended effect of a request method is fully defined by the HTTP specification (...