Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Firefox passes if I click OK in a funny dialog.

308 preserves the HTTP verb[1], and the form on that page uses POST. POST is not idempotent[2], which means using it more than once with the same parameters may not yield the same output. For example, POSTing this comment form twice would append to the resource twice; as opposed to GETing twice which just returns the resource unmodified both times.

Firefox correctly (under the old RFC for a 301 redirect[3]) asks for confirmation before automatically repeating a request that is not guaranteed to be safe to repeat. Some implementations will instead convert the request into a GET, which is why 308 was needed in the first place.

[1]: http://tools.ietf.org/html/rfc7238#section-3

[2]: http://tools.ietf.org/html/rfc2616#section-9.1.2

[3]: http://tools.ietf.org/html/rfc2616#section-10.3.2

Edit: links



No, idempotency doesn't matter because the action is not applied when a 3xx is returned. Proof: permanent 3xx replies are cacheable.

The reason confirmation is asked is because the user might not wish to apply the action to the new URI. (Codified as "safety" in the new 1.1.)

Sources: your links and http://tools.ietf.org/html/rfc7231#section-4.2.1


Responses to POST requests are only cacheable when they include explicit freshness information[1], which is not the case with the linked test page.

[1]: http://tools.ietf.org/html/rfc7231#section-4.3.3




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: