Hacker News new | ask | show | jobs
by paulddraper 829 days ago
Query params.

DELETE cannot have request body, just like GET cannot have a request body.

(Well, it's a syntactically valid HTTP message, but there's no semantic meaning to the body.)

2 comments

Question: what is the proper verb to use with a query? I always thought of it as a GET and passing the query via the body. You are GETting information, rather than trying to add information.

For that matter I've never quite figured out when to use POST vs PUT. POST doesn't feel right for a query.

DELETE and GET can have bodies, the spec is just vague about it. Elasticsearch commonly uses request bodies for GET, treating it identically to POST. It's not always regarded as a good idea, but it does work.
That's why I said:

> (Well, it's a syntactically valid HTTP message, but there's no semantic meaning to the body.)

To quote RFC 9110:

> Although request message framing is independent of the method used, content received in a GET request has no generally defined semantics, cannot alter the meaning or target of the request, and might lead some implementations to reject the request and close the connection because of its potential as a request smuggling attack (Section 11.2 of [HTTP/1.1]). A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported. An origin server SHOULD NOT rely on private agreements to receive content, since participants in HTTP communication are often unaware of intermediaries along the request chain.

For this reason, Elasticsearch also accepts queries as POST.