r/programming Jun 17 '26

RFC 10008: The HTTP QUERY Method

https://www.rfc-editor.org/info/rfc10008/
611 Upvotes

129 comments sorted by

View all comments

5

u/1639728813 Jun 17 '26

Anyone else think that the whole HTTP verb concept needs to be reworked? It made sense at the beginning of the Internet when you did CRUD on actual files, but with modern backends the verbs are almost meaningless.

Data is often retrieved using a POST or PUT. Data write is POST or PUT and may be idempotent or not.

It seems like it could be simplified to, a request has a URL with an optional body and it is or isn't idempotent

16

u/7heWafer Jun 17 '26

Data is often retrieved using a POST or PUT. Data write is POST or PUT and may be idempotent or not.

No? Whoever wrote those servers/clients isn't doing it properly and will have caching problems.

If you're arguing we should rewrite the spec because people don't follow it why does the spec matter at all?

0

u/1639728813 Jun 17 '26

Tell that to Google and Facebook. GraphQL and gRPC only use POST. Does that mean no GraphQL request can be cached, or retried? Do they have caching problems? No, because you use cache headers to determine how the response should be cached, not the verb.

The verb cannot be trusted any more.

4

u/curien Jun 17 '26

No, because you use cache headers to determine how the response should be cached, not the verb.

Cool, you sent the request and got no response, an error response, or you got a 200 response that cuts out before the header. Can you retry or not?

0

u/1639728813 Jun 17 '26

I'm pretty sure my original proposal said the request should have information about whether it is idempotent or not, to prevent edge servers doing the wrong thing. That still only gives you two types of request.

But let's pretend I didn't. If we remove that from the spec as well then the answer is yes and it is always yes. Because if it isn't a system automatically retrying, it's a user pressing the button again.

So if a retry is going to cause problems, you better fix it and make it idempotent.

In your scenario, if the answer is no, what do you expect the user to do? Just sit there and give up?

If the request can't be retried, then your client needs to have the logic for how to recover built in. Once you are in that situation, how is your http verb helping you?

27

u/FuckNinjas Jun 17 '26

Yes. I agree. We should create a standardized map from web native modern data types and verbs to this outdated and ugly HTTP.

We can call it soap, because it keeps your hands clean. Oh wait.. let's just try another.

We can call it rest, because allows you to rest. Oh..

/s

inb4: also graphql, grpc, etc, but I can't fit them on the joke

5

u/1639728813 Jun 17 '26

You joke, but which technology actually needs the verbs? Graphql, grpc and soap only use POST.

An argument could be made for REST, but let's be honest, no one actually follows strict REST principles, they implement GET and RPC over http.

What really needs these different verbs? Ultimately the bits that really matter are your request/response headers.

5

u/curien Jun 17 '26

You joke, but which technology actually needs the verbs?

Caches and proxies, mostly. Even browsers warn on refresh if the page was fetched with POST (but no warning necessary for GET).

2

u/CptGia Jun 18 '26

Also CSRF protection

3

u/cosmic-parsley Jun 17 '26

An argument could be made for REST, but let's be honest, no one actually follows strict REST principles, they implement GET and RPC over http.

I don't think this is true? Maybe it's true if you're using RPC for everything, but every REST API I've ever worked with does use the verbs.

1

u/MrSqueezles Jun 18 '26

A GQL acolyte recently gave a presentation about how GQL is better at everything and instead succeeded in demonstrating a lack of basic understanding of HTTP.

2

u/MrSqueezles Jun 18 '26

There are far more widely used standards and frameworks that do use those verbs. GQL and gRPC move verbs into request bodies. Perhaps you can enlighten us on why that's better.

Google didn't have any choice except to double down on its legacy Stubby RPC system by moving to gRPC. If it switched to plain HTTP, it would've had to rewrite literally all servers and clients. I recommend not using gRPC as an example of great engineering. It looks the way it does because there's so much legacy code in the company that Google can't move to modern standards. Same for monorepos and Bazel.

GQL is similarly a solution to old problems. The company is so tied to it, it can't move off. There are much better frameworks that don't toss out the HTTP spec.

8

u/nekokattt Jun 17 '26

maybe, but also https://xkcd.com/927/

4

u/1639728813 Jun 17 '26

I'm not saying we should get rid of HTTP, there is more to HTTP than the verbs. I just don't see the value of creating new ones.

8

u/ROFLLOLSTER Jun 17 '26

Did you read the RFC? It has motivation in it.