News for hackers. Stuff that matters.

A comment on Volatile – A key-value pair API. Parent comment

Re:Volatile – A key-value pair API by phoe-krk on Tuesday November 12, 2019 @03:50AM (#21512605)
> When all API are GETs, the browser, which is likely to be open when you read this, is all you need.

And your service is also incorrect due to the issues with side-effects mentioned elsewhere in the thread.

[ Parent | on HN ]
Re:Volatile – A key-value pair API by iCarrot on Tuesday November 12, 2019 @05:12AM (#21512972)
It depends on how you interpret correctness. RFC 2616 9.1.1 also used "SHOULD NOT" and not "MUST NOT", indicating that there are valid use cases. The issue is about whether your users are aware of (and are responsible for) the side-effect or not. In this case they are.
[ Parent | on HN ]
Re:Volatile – A key-value pair API by oefrha on Tuesday November 12, 2019 @05:30AM (#21513042)
Except when GET has side effects, one can embed the URL in an img tag and visitors would be triggering that side effect unknowingly. One can do this on most public forums. So no, users may not be aware.
[ Parent | on HN ]
Re:Volatile – A key-value pair API by iCarrot on Tuesday November 12, 2019 @09:17AM (#21514238)
What you just described is actually a web beacon [1], in which case the one that embed the URL is the user (and not the one who load the <img>). Web beacon can be used to implement useful thing like visitor counter service [2].

[1]: https://en.wikipedia.org/wiki/Web_beacon

[2]: https://www.hitwebcounter.com/

[ Parent | on HN ]
Re:Volatile – A key-value pair API by oefrha on Tuesday November 12, 2019 @10:46AM (#21514969)
It's also "useful" for cross-site request forgery.
[ Parent | on HN ]
Re:Volatile – A key-value pair API by iCarrot on Tuesday November 12, 2019 @11:37PM (#21521220)
Cross-site request forgery is only "useful" in auth context. There is no auth in Volatile, nor in the hit counter.
[ Parent | on HN ]