Why should you delete using an HTTP POST or DELETE, rather than GET?

asp.net-mvc http http-delete
Richard Ev picture Richard Ev · Apr 24, 2009 · Viewed 28.7k times · Source

I have been working through Microsoft's ASP.NET MVC tutorials, ending up at this page

http://www.asp.net/learn/mvc/tutorial-32-cs.aspx

The following statement is made towards the bottom of this page:

In general, you don’t want to perform an HTTP GET operation when invoking an action that modifies the state of your web application. When performing a delete, you want to perform an HTTP POST, or better yet, an HTTP DELETE operation.

Is this true? Can anyone offer a more detailed explanation for the rationale behind this statement?

Edit

Wikipedia states the following:

Some methods (for example, HEAD, GET, OPTIONS and TRACE) are defined as safe, which means they are intended only for information retrieval and should not change the state of the server.

By contrast, methods such as POST, PUT and DELETE are intended for actions which may cause side effects either on the server

Answer

Chris Cudmore picture Chris Cudmore · Apr 24, 2009

Jon Skeet's answer is the canonical answer. But: Suppose you have a link:

href = "\myApp\DeleteImportantData.aspx?UserID=27"

and the google-bot comes along and indexes your page? What happens then?

Related questions

Server cannot set status after HTTP headers have been sent IIS7.5

Sometimes I get exception in my production environment: Process information Process ID: 3832 Process name: w3wp.exe Account name: NT AUTHORITY\NETWORK SERVICE Exception information Exception type: System.Web.HttpException Exception message: Server cannot set status after HTTP headers have …

Read More
throwing/returning a 404 actionresult or exception in Asp.net MVC and letting IIS handle it

how do I throw a 404 or FileNotFound exception/result from my action and let IIS use my customErrors config section to show the 404 page? I've defined my customErrors like so <customErrors mode="On" defaultRedirect="/trouble"> <error statusCode="404" …

Read More
Send POST request to asp.net mvc action via Fiddler

I have an ASP.NET MVC web site. One of my routes is a URL that takes 5 parameters. For the sake of illustration, these parameters are named parameter1, parameter2, parameter3, parameter4, and parameter5. Currently, I'm constructing a URL in some …

Read More