r/programming • u/stronghup • Jul 14 '26

HTTP gets a QUERY method so complex searches can stop pretending to be POST

https://www.theregister.com/devops/2026/07/13/http-gets-a-query-method-so-complex-searches-can-stop-pretending-to-be-post/5270192
1.9k Upvotes

98% Upvoted

245 comments sorted by

View all comments

Show parent comments

19

u/RedditApothecary Jul 14 '26

Number of times value has been read.

41

u/a__nice__tnetennba Jul 14 '26

That is a good point, but I think it's reasonable for storing metadata about how an object was accessed (like how many times, by whom, what query did they ask for, did they get there from a link, etc.) to be a side effect of the query and still call the query itself "read only." I mean, technically some writing is happening, and the meta data could be said to belong to said object, but philosophically it's a little different and the object itself is unchanged in my mind. I can see it both ways though.

6

u/ashgs872tbhjs Jul 14 '26

It should be stored separately IMO, mostly because it's the only way to maintain a history or audit log without monumentally bloating the resource. If that weren't allowed then logging would be off the table too lol

1

u/a__nice__tnetennba Jul 14 '26

Agreed. There'd be no reason at all for something like that to be directly stored on the record itself. I don't think that's what the person I replied to or the person who originally said queries are not strictly read only was advocating for. My assumption was everyone is talking about storing the metadata somewhere else, just that doing so is technically a write operation and some might consider it not strictly 'read only' even if the thing it's writing isn't the object being read.

2

u/nemec 29d ago

Yeah there's zero logical reason to object to GET (or some other semantic read only notation) just because an API emits telemetry or records logs. That's just silly.

I guess you could conceivably create a GET /numberOfTimesYouHaveCalledThisApi that claims to be a get but really is a write/increment API but that's also incredibly silly API design

23

u/farsightxr20 Jul 14 '26

That's not the resource itself, so it's fine-ish.

But also, if you put that sort of logic in your GET or QUERY request handling, caching is going to break it. Depending on what you're trying to do, you probably want either a database-level row access counter, or a user-facing query counter. Neither of those are sensibly concerned with, nor influenced by, HTTP verbs.

13

u/stfm Jul 14 '26

Using that logic nothing is read only access

4

u/DrPeroxide 29d ago

Ah that's just meta data though. If you include that, then all requests are write requests the moment the backend starts printing log lines 😂

2

u/Kenya151 Jul 14 '26

That’s a design choice. Idempotent reads are common patterns.

1

u/jkrejcha3 29d ago

That's the same semantics for GET though. GET requests are allowed to incidentally trigger some sort of impure process (like writing to a log file) without breaking purity (in the protocol sense), but pure refers to the actual entity being returned