An endpoint deletes a record when it is fetched with GET. Why is that dangerous?

Question

Accepted Answer

GET is defined as safe, so crawlers and prefetchers will trigger the deletion — Safe means a request has no side effects the user is accountable for, and everything from search crawlers to link prefetchers relies on that — which is how a GET-triggered delete wipes data nobody asked to remove. GET can carry an identifier in the path or query, caching is conditional rather than automatic, and GET is in fact idempotent.

Answer

GET cannot carry a request body, so the record identifier has nowhere to go

Answer

GET responses are always cached, so the second deletion never reaches the server

Answer

GET is not idempotent, so a retried request would delete more than one record

An endpoint deletes a record when it is fetched with GET. Why is that dangerous?

Why this is the answer

More HTTP & Networking flashcards