Hacker News new | ask | show | jobs
by CommonGuy 5 hours ago
Proxies are allowed to drop bodies of HTTP GET requests.

RFC 9110 states:

> [..] content received in a GET request has no generally defined semantics, cannot alter the meaning or target of the request [..]

> A client SHOULD NOT generate content in a GET request [..]
2 comments
degamad 4 hours ago
> ... unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.

You left out the important part.

link
lightningspirit 41 minutes ago
How does the origin server indicate that?
link
magicalhippo 4 hours ago
Even HTTP 1.0 RFC[11] is fairly clear on this, although it doesn't explicitly spell it out like RFC 9110. GET requests should only consider the Request-URI and request bodies should only be included if the method calls for it.

[1]: https://www.rfc-editor.org/info/rfc1945/

link