API - use GET to add, edit, and delete?

Question

I'm building an API and want Ajax to be able to interact with it. The API needs to allow inserting, updating, and deletion of data. Is it a good idea to allow any of these operations via GET?

For example: http://api.domain.com/insert_person/?name=joe

My original plan way to use GET for my "getting" methods (basically, just a simple DB query) and POST for add, edit, and delete. Problem is JS same-origin policy which would make it hard for Ajax to interact with my API. There is a jQuery workaround for GET (via JSONP).

Suggestions?

Paul · Accepted Answer · 2011-05-26 04:20:02Z

5

In a word: NO

GET should always be used only for retrieving information and should never have side effects, ever.

This is a best practice across just about every web api out there and has to do with both the intent of the verb as well as how existing software expects things to behave.

answered May 26, 2011 at 4:20

Paul

36.4k12 gold badges98 silver badges124 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

StackOverflowNewbie Over a year ago

What do you think about using POST for inserting, updating, and deleting?

Paul Over a year ago

that's pretty much the only option in most browsers, though modern ones are starting to support PUT and DELETE verbs. Generally, following the verbs is a good idea unless you have constraints preventing it, e.g. en.wikipedia.org/wiki/Representational_State_Transfer

Matty F · Accepted Answer · 2011-05-26 04:22:45Z

1

If you're trying to get around the same origin policy, GET via JSONP is the only possible front-end solution. If you've got control of the back end you can setup a proxy service that is on the same domain as the page, but relays to and from the API service.

If you're going to go down the JSONP GET path, make sure you read up on XSS and CSRF.

answered May 26, 2011 at 4:22

Matty F

3,7934 gold badges33 silver badges48 bronze badges

1 Comment

StackOverflowNewbie Over a year ago

can you elaborate on the proxy service? I'm not sure about how to do it. Thanks.

Ibu · Accepted Answer · 2011-05-26 04:24:18Z

1

Add another layer of to handle your code and interact with your database (different domain).

You would still use POST and you can make a request to your db in the server side, using what ever language your are working with, example php will use curl.(to make request to a different domain)

If you allow to interact with your db using get, then anyone can simply type the url with the commands they want, so yes avoid it .

answered May 26, 2011 at 4:24

Ibu

44k14 gold badges82 silver badges109 bronze badges

Comments

hammar · Accepted Answer · 2011-05-26 04:28:52Z

0

As others have pointed out, GET should not be used for actions with side effects like inserting, updating and deleting.

To allow cross-origin use of your API, look into Cross-Origin Resource Sharing, although it's currently only partially supported by browsers.

answered May 26, 2011 at 4:28

hammar

140k18 gold badges310 silver badges388 bronze badges

Collectives™ on Stack Overflow

API - use GET to add, edit, and delete?

4 Answers 4

2 Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related