Web Fundamentals · Flashcard
An endpoint deletes a record when it is fetched with GET. Why is that dangerous?
- AGET is defined as safe, so crawlers and prefetchers will trigger the deletion
- BGET cannot carry a request body, so the record identifier has nowhere to go
- CGET responses are always cached, so the second deletion never reaches the server
- DGET is not idempotent, so a retried request would delete more than one record
Why this is the answer
Safe means a request has no side effects the user is accountable for, and everything from search crawlers to link prefetchers relies on that — which is how a GET-triggered delete wipes data nobody asked to remove. GET can carry an identifier in the path or query, caching is conditional rather than automatic, and GET is in fact idempotent.
Official docs