News for hackers. Stuff that matters.

A comment on Monzo urges 480k customers to change their pin numbers. Parent comment

Re:Monzo urges 480k customers to change their pin numbers by buro9 on Tuesday August 06, 2019 @09:01AM (#20624720)
It should have been a POST.

Idempotency and implications for which operations can be cached is why.

GETs are cacheable, but if a PIN can change so can the answer. This is an authentication action, and it should have been POST.

[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by BillinghamJ on Tuesday August 06, 2019 @09:08AM (#20624776)
imo this is exactly the sort of situation where if you can't implement perfectly "clean" REST, you shouldn't try at all and just use a simplified RPC mechanism only instead.

For my company, it's all POST-only, no URL params allowed, all inputs as JSON in the body only, no resource IDs in the path - just the method & version only.

[ Parent | on HN ]