Monday, April 25, 2011

Should I store _method=PUT/DELETE in the post or in the url

I'm using ASP.NET MVC to build a RESTful web application and I plan to tunnel PUT and DELETE requests through POST as it seems like the most pragmatic workaround.

What I'd like to know is, should I tunnel the information through the url like this:

<form method='post' action='resource?_method=DELETE'>
    <!-- fields -->
</form>

Or should I tunnel it through the posted form data like this:

<form method='post' action='resource'>
    <input type='hidden' name='_method' value='DELETE' />
    <!-- fields -->
</form>

And what are the pros and cons of each?

EDIT: One of the reasons I asked the question is that I read somewhere that putting information like this in the url is a good thing as post data usually gets lost, but urls hang around (in log files, etc) - unfortunately it makes the url look ugly

From stackoverflow
  • They are equivalent.

    Though if pressed I'd prefer sending it in the post myself, but it's subjective.

  • Have you seen this question? From what I understand, the x-http-method-override header is the preferred solution to this problem.

    Jacob Stanley : Is x-http-method-override something that I can use from a browser that has javascript disabled?
    Darrel Miller : I'm not aware of a way to do it without javascript enabled.
  • Not that I have, but shouldn't you use:

    <form method="put" action="resource">
        <!-- fields -->
    </form>
    

    And / or

    <form method="delete" action="resource">
        <!-- fields -->
    </form>
    

    ...?

    Jacob Stanley : I'd love to, but this is not supported by most web browsers (and indeed the HTML/XHTML spec)
    Charlino : I see. Personally I'd put it in the post because that's where all the other info for the request is. Where did you read that it's better in the URL?
    Jacob Stanley : I can't remember, but it's a good point that things like urls are logged. If I check my request log I can see 'POST /resource?_method=DELETE' instead of just 'POST /resource'

0 comments:

Post a Comment