Re:Monzo urges 480k customers to change their pin numbers
by ancarda on Tuesday August 06, 2019 @08:57AM
(#20624695)
Can't you send a body with a GET request? Why change the request to POST/something else if GET was a better semantic match?
[ Parent
| on HN ]
Re:Monzo urges 480k customers to change their pin numbers
by buro9 on Tuesday August 06, 2019 @09:01AM
(#20624720)
It should have been a POST.
Idempotency and implications for which operations can be cached is why.
GETs are cacheable, but if a PIN can change so can the answer. This is an authentication action, and it should have been POST.
Re:Monzo urges 480k customers to change their pin numbers
by BillinghamJ on Tuesday August 06, 2019 @09:08AM
(#20624776)
imo this is exactly the sort of situation where if you can't implement perfectly "clean" REST, you shouldn't try at all and just use a simplified RPC mechanism only instead.
For my company, it's all POST-only, no URL params allowed, all inputs as JSON in the body only, no resource IDs in the path - just the method & version only.
Re:Monzo urges 480k customers to change their pin numbers
by lol768 on Tuesday August 06, 2019 @09:01AM
(#20624719)
You can, but it's unusual. Probably best to implement the most obvious fix, particularly because a lot of libraries (and engineers) will associate data with the query string in the context of a GET request.
Principle of least surprise and all that.