152 votes
Accepted

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

Alice wants to pay Bob for a service. Bob has quoted her $10. Give this quote a unique token. Alice clicks pay. When this response is send to the server, it must go with the token of ...
Theraot's user avatar
  • 9,131
60 votes

Should we create a new single instance of HttpClient for all requests?

It seems like a compelling blog post. However, before making a decision, I would first run the same tests that the blog writer ran, but on your own code. I would also try and find out a bit more ...
Robert Harvey's user avatar
58 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

A quote should be a write-once record. Bob isn't allowed to edit it once it has been created and passed to Alice. You can ensure this at different levels, from simply not offering an edit dialog to ...
Hans-Martin Mosner's user avatar
39 votes

What belongs in an HTTP request header vs the request body?

While the line is somewhat blurry, for me a rule of thumb is: data that your business logic works on should be in the body, metadata can/should be put in headers. Another way of looking at it is: ...
Michał Kosmulski's user avatar
38 votes

Should we create a new single instance of HttpClient for all requests?

I'm late to the party, but here is my learning journey on this tricky topic. 1. Where can we find the official advocate on reusing HttpClient? I mean, if reusing HttpClient is intended and doing so ...
RayLuo's user avatar
  • 691
29 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

This must be an extremely common problem to deal with, no? No, it isn't. I doubt you'll be able to find a payment processor that lets you change the amount after the customer has authorised a ...
Caleth's user avatar
  • 11.1k
24 votes

Should we create a new single instance of HttpClient for all requests?

I did some tests and saw performance improvements with static HttpClient. I used below code for my testing: namespace HttpClientTest { using System; using System.Net.Http; class Program ...
Ankit Vijay's user avatar
  • 1,588
20 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

Just send the amount Alice agreed to pay along with the request. If the price has increased since Alice sent the request, you send a response indicating that the item could not be purchased at or ...
cjs's user avatar
  • 787
16 votes
Accepted

What is a proper response status code to POST when parent resource is not found?

404 NOT FOUND seems to be an appropriate response, because the resource with this ID does not exist. It's very clear to understand and you are expecting the same response if a/{id} is called. 409 ...
Dherik's user avatar
  • 2,446
15 votes

Use Case of HTTP GET Request with a Body

GET requests with a body are supported in the HTML specs. See the Stack Overflow question Is this statement correct? HTTP GET method always has no message body for a discussion. However, it's unusual. ...
Ewan's user avatar
  • 75.8k
14 votes
Accepted

What reasons are there AGAINST using only POST HTTP verb in an API?

"What reasons are there AGAINST using only POST HTTP verb in an API?" You have answered your own question: The goal is to be very quick and easy to adapt and use for other developers... If your ...
Dan Wilson's user avatar
  • 3,103
13 votes
Accepted

What makes (or why is) a language Server-Side?

the solid, defining line on can/can't be server-side by taking requests and returning a database call, that is puzzling. Quite puzzling, I'd imagine, given that such a line does not exist for ...
8bittree's user avatar
  • 5,656
13 votes

How to map "mv" operation to HTTP verbs?

Is there a RESTful way to implement this whilst maintaining atomicity of the operation? Short Answer Just use POST Medium Answer Seriously; it is okay to use POST. POST serves many useful purposes ...
VoiceOfUnreason's user avatar
9 votes
Accepted

Is there an industry-standard equivalent to cURL?

Is there an industry standard? You betchya. It's the actual Http protocol. An actual Http Request looks something like this. POST /cgi-bin/process.cgi HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; ...
RubberDuck's user avatar
  • 8,971
8 votes

How do searches fit into a RESTful interface?

This is an old answer but I still can contribute a bit to the discussion. I've observed very often a misunderstanding of REST, RESTful and Architecture. RESTful doesn't ever mention anything about NOT ...
Maximiliano Rios's user avatar
8 votes
Accepted

What is the right way to make HTTP requests when a slider's value changes?

It really depends on how you intend to provide feedback and how quickly your hardware controller can respond. There is more than one way to handle this, and the correctness of the solution really ...
Berin Loritsch's user avatar
8 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

Yes this is a common issue, and it is about transactional consistency. To summarize your issues: the quote is binding for the seller. In general it has a reference and an expiration date/time. the ...
Christophe's user avatar
  • 77.3k
8 votes

Email Confirmation links must be GET, but not safe

Let's have a look into the RFC-7231: 4.2.1. Safe Methods. Safe methods are allowed to do state changes, althoug it is highly not recommended. So this is not a violation of the Standard. It's more a ...
Simulant's user avatar
  • 204
8 votes

HTTP REST API: Is it wrong to put search parameters in a custom header?

One of the main ideas behind REST is that each resource should be identifiable by a unique URL, and requesting a resource should be as simple as requesting this URL. When you transfer search ...
mentallurg's user avatar
7 votes

REST Webservices (post / put) : which type of parameter should I choose, and when?

REST API over HTTP 1.1 These are the "principles" we consider when parenting to be make a Web API. But not the only! See also CoRE RFC6690) Path variables Used to identify resources within a ...
Laiv's user avatar
  • 14.6k
7 votes
Accepted

REST API - omitted properties in POST request: How should they be handled?

For an update (POST) request, a field that is omitted should not be changed. To clear a field from it's value, it should be mentioned in the request with the value null or a normal value to change the ...
David Perfors's user avatar
7 votes
Accepted

Is get and post interchangeable?

Yes given you have control over the server's handling of this. I worked with some java server code that treated both methods as equivalent. In fact, the operation is really just a string that is ...
JimmyJames's user avatar
  • 27.3k
7 votes

What is a proper response status code to POST when parent resource is not found?

In addition to @Dherik's answer. URIs are identifiers, so we have to keep in mind that (/a/{id}/b is an identifier). The URI is meaningless for the WWW, and so is for the HTTP client. 404 is the right ...
Laiv's user avatar
  • 14.6k
7 votes

What reasons are there AGAINST using only POST HTTP verb in an API?

If you want to make things easy for developers using your api, don't worry about the RESTfulness of various verbs. Publish A Client If you publish a client then GET or POST is an implementation ...
Ewan's user avatar
  • 75.8k
7 votes

What reasons are there AGAINST using only POST HTTP verb in an API?

I added this comment here, but I wanted to elaborate on my reasoning in an answer. When we talk about APIs, usually we mean remote APIs, especially HTTP REST APIs. But API stands for Application ...
Ferran Maylinch's user avatar
7 votes
Accepted

Email Confirmation links must be GET, but not safe

Rather than being language lawyers and analysing the spec, let's look at the possible downside of a GET request changing the state in this case: The action might be triggered without user interaction,...
IMSoP's user avatar
  • 5,857
6 votes
Accepted

How to limit the amount of requests by minute to a external system on a micro services environment?

I think this is all about resilience :) What happens, if the request limitation is reached? Will "responsys" just throw an error or really tell the calling microservice that it hit the limit? Will ...
Alejandro Alanis's user avatar
6 votes

Client-side XHR request, which IP does the endpoint read?

The browser will download the contents of the JavaScript file and execute it - this all happens on the client's machine, so the XHR request will have the IP address from the client. It doesn't really ...
Glorfindel's user avatar
  • 3,137
6 votes
Accepted

How do I create an HTTP PUT request that modifies the resource in many ways

A PUT request should completely replace the resource, so this is essentially a non-issue. If you want to update multiple aspects while keeping some information, PATCH is the right verb to use, and you ...
Hans-Martin Mosner's user avatar
6 votes

How to map "mv" operation to HTTP verbs?

One possible solution might indeed be to drop that "should not (imho) imply a DELETE". While it is somewhat counterintuitive that a constructive REST verb (POST) could have a destructive ...
Hans-Martin Mosner's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible