83 messages in org.w3.www-tagRE: draft findings on Unsafe Methods ...
FromSent OnAttachments
Dan ConnollyApr 15, 2002 8:50 am 
Larry MasinterApr 15, 2002 1:44 pm 
David OrchardApr 15, 2002 3:01 pm 
David OrchardApr 15, 2002 3:19 pm 
Mark BakerApr 15, 2002 8:00 pm 
Keith MooreApr 15, 2002 8:37 pm 
Scott CantorApr 15, 2002 9:28 pm 
Edwin KhodabakchianApr 15, 2002 9:34 pm 
David OrchardApr 15, 2002 10:18 pm 
Paul PrescodApr 15, 2002 11:17 pm 
Tim BrayApr 15, 2002 11:32 pm 
Mark NottinghamApr 16, 2002 1:01 am 
Tim BrayApr 16, 2002 1:02 am 
Mark NottinghamApr 16, 2002 1:09 am 
Paul PrescodApr 16, 2002 2:11 am 
Paul PrescodApr 16, 2002 3:02 am 
Mark BakerApr 16, 2002 4:54 am 
Williams, StuartApr 16, 2002 8:22 am 
Keith MooreApr 16, 2002 8:32 am 
jon...@research.att.comApr 16, 2002 8:44 am 
Scott CantorApr 16, 2002 8:55 am 
Paul PrescodApr 16, 2002 9:40 am 
Mark NottinghamApr 16, 2002 9:42 am 
Hutchison, NigelApr 16, 2002 9:43 am 
Henrik Frystyk NielsenApr 16, 2002 10:48 am 
Bullard, Claude L (Len)Apr 16, 2002 1:46 pm 
Larry MasinterApr 16, 2002 6:39 pm 
Roy T. FieldingApr 16, 2002 7:54 pm 
Larry MasinterApr 16, 2002 10:10 pm 
Graham KlyneApr 17, 2002 1:54 am 
Paul PrescodApr 18, 2002 12:33 am 
Graham KlyneApr 18, 2002 9:11 am 
Alex RousskovApr 18, 2002 9:30 am 
Paul PrescodApr 18, 2002 9:45 am 
Graham KlyneApr 18, 2002 11:58 am 
Roy T. FieldingApr 18, 2002 3:11 pm 
Don BoxApr 18, 2002 6:28 pm 
Mark BakerApr 18, 2002 8:50 pm 
Keith MooreApr 18, 2002 8:54 pm 
Paul PrescodApr 18, 2002 10:00 pm 
Graham KlyneApr 19, 2002 12:53 am 
Bill de hÓraApr 19, 2002 4:18 am 
Roy T. FieldingApr 19, 2002 1:20 pm 
Anne Thomas ManesApr 22, 2002 3:23 pm 
Paul PrescodApr 22, 2002 4:01 pm 
Anne Thomas ManesApr 22, 2002 8:17 pm 
Paul PrescodApr 22, 2002 10:21 pm 
Anne Thomas ManesApr 23, 2002 5:36 am 
Paul PrescodApr 23, 2002 12:03 pm 
Paul PrescodApr 23, 2002 2:09 pm 
Roy T. FieldingApr 23, 2002 2:14 pm 
Bullard, Claude L (Len)Apr 23, 2002 2:50 pm 
Joshua AllenApr 23, 2002 2:53 pm 
David OrchardApr 23, 2002 4:14 pm 
Keith MooreApr 23, 2002 5:05 pm 
Roy T. FieldingApr 23, 2002 5:14 pm 
Simon St.LaurentApr 23, 2002 5:18 pm 
Larry MasinterApr 23, 2002 6:31 pm 
Mark BakerApr 23, 2002 6:36 pm 
Paul PrescodApr 23, 2002 8:03 pm 
Tim BrayApr 23, 2002 8:30 pm 
Dan ConnollyApr 23, 2002 9:05 pm 
Joshua AllenApr 23, 2002 9:10 pm 
Anne Thomas ManesApr 23, 2002 9:28 pm 
Mark NottinghamApr 23, 2002 9:42 pm 
Jeff BoneApr 23, 2002 9:42 pm 
Joshua AllenApr 23, 2002 10:02 pm 
Paul PrescodApr 23, 2002 10:05 pm 
Joshua AllenApr 23, 2002 10:27 pm 
Joshua AllenApr 23, 2002 10:38 pm 
Mark NottinghamApr 23, 2002 10:57 pm 
Mark NottinghamApr 23, 2002 11:16 pm 
Joshua AllenApr 23, 2002 11:20 pm 
Dan ConnollyApr 23, 2002 11:23 pm 
Tim BrayApr 23, 2002 11:56 pm 
Bullard, Claude L (Len)Apr 24, 2002 7:23 am 
Larry MasinterApr 24, 2002 8:47 am 
Keith MooreApr 24, 2002 10:46 am 
Bullard, Claude L (Len)Apr 24, 2002 10:56 am 
Aaron SwartzApr 24, 2002 11:27 am 
Mike DierkenApr 24, 2002 12:06 pm 
David OrchardApr 25, 2002 10:54 am 
Roy T. FieldingMay 5, 2002 3:38 am 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:RE: draft findings on Unsafe Methods (whenToUseGet-7)Actions...
From:Larry Masinter (LM@acm.org)
Date:Apr 15, 2002 1:44:56 pm
List:org.w3.www-tag

The issue of safe HTTP request methods and "safe" responses was discussed at length in the HTTP working group. It was noted that the request method is not the determiner of safety, but rather the server was the final arbiter. RFC 2310 ("The Safe Response Header Field") was proposed as one way that the origin server could note the safety of methods. The interesting observation was that most of the use cases only required knowledge of safety after the fact, and not a priori.

A great deal of the utility of the Web depends on the ability of users (and agents) to explore the shared information space safely; to explore a page and come back, without channging anything. A very important principle when designing Web applications is: * safe methods (GET/HEAD) should be used for safe operations: read, query, view, ask, lookup * safe methods must not be used for unsafe operations: write, update, modify, tell, buy, agree

This wasn't supported in the use cases we looked at. Whether or not the GET method was "safe" was up to the server. Servers should, of course, be aware that there will be applications (web crawlers, cache warmers, etc.) that will pre-fetch GET data.

It may be that you mean something other than "safe", such as "freely callable without worry", whether or not the results actually are safe.

I don't find anything in the design of GET and HTTP that supports your conclusion, that the "get" method should be used when the "form is idempotent". In fact, it isn't a property of the form at all, it's a property of the processor of the form at the time the form is processed, to decide whether the form submission is or isn't idempotent. And there's no use case for having client software, search service crawlers or caching proxies automatically submit forms in advance, whether or not they are "idempotent".