REST API: GET request with body

Question

I want to implement a REST API and need a body on my GET requests. (Like discussed here: HTTP GET with request body)

Are there http clients which are not able to send a body with a GET request? Fiddler is able to do it, although the message box is red.

Jacquiline

Answer 1

As a general rule, the idea of a GET in REST is that any of your parameters are sent in the URL. As the answer on the question you included indicates, it's doable but misses the point of REST, which is to have a consistent webbish interface. If you want to pass complex data to your endpoint, you probably want to use a POST, which your users will expect to have a body for. I'd highly recommend reconsidering that implementation.

But to your actual question, sure there are clients that can't send a body on a GET. Mostly I'd imagine your clients will be programmatic, say, python's urlib2, and while you can set a body on GET, it is not really the intended use of the module, so you're forcing the programmer to get weird. More importantly, the idea of the REST api is to be client-agnostic, which is why it sounds to me like your API design should be reworked here.

Tollefson

Yes this would be my second choice. Its true that using a body on a GET request is not fully restful, but its necessary. URL length is limited and has often problems with complex data. If there is no possibility for GET I will use POST, but users will exspect POST for creating and GET for retrieving data. However, I see no other option. – Jacquiline

I see the point, but I think that it will feel less mutant to users to imagine the POST endpoint as a service provider that is processing their complex XML/JSON data and responding with the result, than it will to create a non-standard GET request. POST is frequently used in this way, GET is not. – Tollefson

Can anyone point to any web RFCs, etc. that support the statement that "GET in REST... parameters are sent in the URL?" I don't see it in Roy Fielding's dissertation but I could be missing it. I'd prefer not to base my choices on an SO answer and to share this convention with others, cogent though the answer may be. (+1 BTW) – Mismanage

from the HTTP spec: "The GET method means retrieve whatever information (in the form of an entity) is identified by the Request-URI." (emphasis mine) So it follows that parameters are in the URI, and not in the body, since "The POST method is used to request that the origin server accept the entity enclosed in the request" -ibid – Tollefson

I would like to know the meaning of client-agnostic in plain English. I googled it and it means client-doubter , Is this correct ? – Jung

@stom In this context "client agnostic" means "regardless of which particular client". That is, regardless of whether the REST api is accessed via CURL, a python script, Firefox, or any other client capable of making HTTP requests. – Tollefson

Answer 2

It's a bad idea to use body in GET HTTP requests. Yes, seems to be that "de jure" HTTP GET can have body, but "de facto" you will be have problems:

1. With client frameworks/libraries. It will be hard to find support of it.
2. Server can just ignore the body of GET Request. And anyway it's not standard way, and could be problems with server or it's configuration.
3. It makes your code, especially on server side, unclear to others, because nobody will expect GET with body.

Are you looking for hard way? With GET with body you will got so many pitfalls. Why not to use other HTTP Verb?

For example use POST (or some other verbs), than:

1. it's easy to have already ready client library,
2. no problems with server or server configuration,
3. it's clear to other

Do not look for harder ways :)

Shrieve

Can you justify "And anyway it's not standard way", pls. What "standard" are you referring to? – Banta

I am referring HTTP standards and RFC papers, e.g. tools.ietf.org/html/rfc2616 . HTTP GET requests with body are non-standard – Shrieve

Well, the HTTP 1.1 seems to allow message-body for GET requests (by not prohibiting it): A message-body MUST NOT be included in a request if the specification of the request method (section 5.1.1) does not allow sending an entity-body in requests. The GET specification in 5.1.1 doesn't seem to "not allow". – Banta

@G.Stoynev, is a POST message supposed to return complex-object bodies? – Reclinate

Why not to use other HTTP Verb? - because many existing 3rd party apis do not know anything about protocol violation.. require payload as body in GET methods – Aronow

Answer 3

work around if there is no other way than send GET request with body:

httpRequest.Method = "POST";
httpRequest.WriteBytes(bytes);
httpRequest.Method = "GET";

Aronow