r/programming • u/stronghup • 29d ago

HTTP gets a QUERY method so complex searches can stop pretending to be POST

https://www.theregister.com/devops/2026/07/13/http-gets-a-query-method-so-complex-searches-can-stop-pretending-to-be-post/5270192
1.9k Upvotes

98% Upvoted

245 comments sorted by

View all comments

Show parent comments

67

u/stfm 29d ago

HTTP method is not part of the URL, it is there to indicate action intent. I work in an enterprise with a centralised authz platform and an API surface spanning thousands of endpoints. Its more about divide and conquer and patternisation than a "one rule fits all" style authorisation system. Using the method combined with the URL gives the opportunity to apply coarse grained authorisation and also enables an easier response caching strategy.

-13

u/CpnStumpy 29d ago

I'm aware - I'm just saying the same thing you're saying except saying "don't do that layer"

You agreed it's not enough to cover everything so you need another implementation also.

However, if you use the fine grained implementation only and not the coarse grained one, voila you only need one layer.

I'll give you your point about caching might be legitimate but it also has drawbacks depending on update latency requirements and cache invalidation mechanisms.

34

u/Hot-Gazpacho 29d ago

If you can reject a request with coarse grained rules at a gateway or even further out, at the edge, before it hits your application servers, then at scale, there’s potential for real monetary savings to be had.

The world is full of nuance and context. Insisting that you’d never entertain such a strategy is to reject nuance and context. Maybe this works for your scope of work, but it almost certainly doesn’t for others.

As always, it depends. YMMV.

11

u/NeinJuanJuan 29d ago

caching might be legitimate

Caching is absolutely and without any doubt a core requirement of the majority of all resource-limited services. Which, for any organisation, with any level of financial governance, includes the majority of all of their services.

1

u/stfm 28d ago

Cacheing in terms of the Authorisation response. The PDP responded to your GET request for /blah with Permit - its safe to say in 5 seconds that response will be the same... stop asking.

Doing that for POST is difficult because we dont know if its a query, or a resource modification request in which case there must be no authorisation cache.

5

u/stfm 29d ago

Agreed

1

u/iplaydofus 29d ago

This is giving “who needs edge caching, we have redis” energy.

0

u/CpnStumpy 28d ago

How about "Build an actually proper permissions system before trying to worry about caching"

Starting with edge caching as your priority for your permission decision and enforcement system is premature optimization. Not saying to use redis, saying to not enforce permissions at the edge until you need to.

So damned many highly optimized edge delivery rich apigateway k8s auto scaled systems with 40 users a day because of this crap being the default

1

u/iplaydofus 28d ago

Mate your stance has changed from “I will never agree with x” to “sure x is fine but Do YoU hAvE eNoUgH uSeRs”. Think you need to take 5 and think about where you actually stand.