滥用 HTTP POST
目前正在阅读 Bloch 的Effective Java（第 2 版），他用粗体指出，在 Web 应用程序中过度使用 POST 本质上是不好的。不幸的是，他没有具体说明原因。
这让我吃了一惊，因为当我进行任何 Web 开发时，我所使用的都是 POST！出于安全原因，我一直避开 GET，因为它感觉更专业（长、难看的 URL 总是因为某种原因困扰我）。
GET 和 POST 之间是否存在性能差异？谁能详细说明为什么过度使用 POST 不好，为什么？我的理解和初步搜索似乎都表明网络服务器对这两者的处理非常相似。提前致谢！
Currently reading Bloch's Effective Java (2nd Edition) and he makes a point to state, in bold, that overusing POSTs in web applications is inherently bad. Unfortunately, he doesn't specify why.
This startled me, because when I do any web development, all I ever use are POSTs! I have always steered clear of GETs for security reasons and because it felt more professional (long, unsightly URLs always bother me for some reason).
Are there performance differentials between GET and POST? Can anyone elaborate on why overusing POSTs is bad, and why? My understanding - and preliminary searches - seem to all indicate that these two are handles very similarly by the web server. Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您应该使用 HTTP，因为它应该被使用。
GET 应该用于幂等、读取查询（即查看项目、搜索产品等）。
POST 应该用于创建、删除或更新请求（即删除项目、更新配置文件等）。GET
允许刷新页面、为其添加书签、将 URL 发送给某人。 POST 不允许这样做。一个有用的模式是 post/redirect/get （也称为发布后重定向）。
请注意，除了长搜索表单外，GET URL 应该很短。它们通常应该类似于 http://www.foo.com/app/product/ view?productId=1245，甚至http://www.foo.com/app/product/view/1245
You should use HTTP as it's supposed to be used.
GET should be used for idempotent, read queries (i.e. view an item, search for a product, etc.).
POST should be used for create, delete or update requests (i.e. delete an item, update a profile, etc.)
GET allows refreshing the page, bookmark it, send the URL to someone. POST doesn't allow that. A useful pattern is post/redirect/get (AKA redirect after post).
Note that, except for long search forms, GET URLs should be short. They should usually look like http://www.foo.com/app/product/view?productId=1245, or even http://www.foo.com/app/product/view/1245
在请求内容时，您几乎总是应该使用
GET。仅在以下情况下使用POST：POST进行更改，使用PUT进行添加，使用DELETE进行删除。）区别如下：如果您想提供链接将页面发送给朋友，或将其保存在某处，或者甚至仅将其添加到您的书签，您需要该页面的完整 URL。就像您的地址栏此时应该显示
http://stackoverflow.com/questions/7810876/abusing-http-post一样。您可以按 Ctrl-C 进行操作。你可以保存它。再次输入该链接，您将返回此页面。现在，当您使用
GET以外的任何操作时，根本就没有可复制的 URL。就像您的浏览器会显示您位于http://stackoverflow.com/question一样。你无法复制它。您无法为其添加书签。此外，如果您尝试重新加载此页面，您的浏览器会询问您是否要再次发送数据，这对于页面的非技术用户来说相当混乱。并且让整个休息都很烦人。但是，传输数据时应该使用
POST/PUT。 URL 只能这么长。您无法在 URL 中传输整个博客文章。另外，如果您重新加载这样的页面，您几乎肯定会重复发布，因为上述消息不会出现。GET和POST非常不同。选择适合该工作的人。You should almost always use
GETwhen requesting content. Only usePOSTwhen you are either:POSTto change,PUTto add andDELETEto delete.)Here's the difference: If you want to give the link to the page to a friend, or save it somewhere, or even only add it to your bookmarks, you need the full URL of the page. Just like your address bar should say
http://stackoverflow.com/questions/7810876/abusing-http-postat the moment. You can Ctrl-C that. You can save that. Enter that link again, you're back at this page.Now when you use any action other than
GET, there is simply no URL to copy. It's like your browser would say you are athttp://stackoverflow.com/question. You can't copy that. You can't bookmark that. Besides, if you would try to reload this page, your browser would ask you whether you want to send the data again, which is rather confusing for the non-tech-savy users of your page. And annoying for the entire rest.However, you should use
POST/PUTwhen transferring data. URL's can only be so long. You can't transmit an entire blog post in an URL. Also, if you reload such a page, You'll almost certainly double-post, because the above described message does not appear.GETandPOSTare very different. Choose the right one for the job.如果您出于安全原因使用 POST，我可能会在这里提及其他安全因素。即使您使用的是 POST，您也需要确保以加密形式发送表单提交中的数据。
至于GET和POST的区别，很简单，GET就是用来发送GET请求的。因此，您希望从页面获取数据并对其进行操作，这就是一切的结束。
另一方面，POST 用于将数据 POST 到应用程序。我这里谈论的是事务（完成创建、更新或删除操作）。
如果您有一个敏感应用程序，需要使用 ID 来删除用户。您不会希望使用 GET 来实现此目的，因为在这种情况下，聪明的用户可能会引发混乱，只需更改 URL 末尾的 ID 并删除所有随机使用即可。
POST 允许更多数据，并且也可以被黑客攻击以发送文件流。但 GET 的大小是有限的。
使用 GET 或 POST 几乎没有任何权衡。
If you are using POST for security reasons, I might drop a mention of other security factors here. You need to ensure that you send the data from a form submit in encrypted form even if you are using POST.
As for the difference between GET and POST, it is as simple as GET is used to send a GET request. So, you would want to get data from a page and act upon it and that is the end of everything.
POST on the other hand, is used to POST data to the application. I am talking about transactions here (complete create, update or delete operations).
If you have a sensitive application that takes, say and ID to delete a user. You would not want to use GET for it because in that case, a witty user may raise mayhem simply changing the ID at the end of the URL and deleting all random uses.
POST allows more data and can be hacked to send streams of files as well. GET has a limited size though.
There is hardly any tradeoff in using GET or POST.