News for hackers. Stuff that matters.

A comment on How Not to write a "REST" API. Parent comment

Re:How Not to write a "REST" API by carbocation on Wednesday February 01, 2012 @11:23AM (#3538587)
I agree with your concerns. But my comment was talking about "typical server logs" and HTTPS-POST vs HTTP-GET, while yours is addressing different issues.
[ Parent | on HN ]
Re:How Not to write a "REST" API by SomeOtherGuy2 on Wednesday February 01, 2012 @12:46PM (#3539034)
I addressed why what gets in logs doesn't matter: if their server is compromised you have to assume you are boned anyways. And I don't understand why is your comment would be talking about "HTTP-GET"? The API in question is dealing with HTTPS for both GET and POST requests.
[ Parent | on HN ]
Re:How Not to write a "REST" API by cristoperb on Wednesday February 01, 2012 @04:17PM (#3539976)
I don't understand why your comments pointing out details of the http spec and common-sense security considerations are being downvoted. I guess they are coming across as overly 'stident'? Anyway, I've found them helpful. Thanks.
[ Parent | on HN ]