Understand the fundamental differences between HTTP GET and POST methods to choose the right one for data visibility, security, and idempotency.
What it is
HTTP defines several request methods. GET and POST are the two most common ways a browser sends data to a server. GET requests retrieve data by appending parameters to the URL query string. POST requests send data in the request body, typically used when submitting forms or creating new resources. Related terms include "query string," "request payload," and "idempotent" (meaning making the same request multiple times has no additional effect).
Why it matters
- Data Visibility: GET parameters appear in the browser address bar and server logs; POST data does not.
- Security: Never use GET for sensitive information like passwords, as URLs are often cached or shared.
- Length Limits: Browsers and servers impose limits on URL length (often ~2048 characters), restricting GET data size.
- Caching: GET responses can be cached by browsers and CDNs; POST responses generally cannot.
- Idempotency: GET should never change server state. POST may create or update resources.
Syntax or steps
A GET request looks like this: /search?q=html&method=get. The data is part of the URL. A POST request sends data separately from the URL, usually within an HTML form or via JavaScript fetch. In HTML, you specify the method in the <form> tag using the method attribute.
Example
<!DOCTYPE html>
<html>
<body>
<!-- GET Example: Data visible in URL -->
<form action="/search" method="get">
<label>Search:</label>
<input type="text" name="q" value="html">
<button type="submit">Go</button>
</form>
<!-- POST Example: Data hidden in body -->
<form action="/login" method="post">
<label>User:</label>
<input type="text" name="username">
<label>Pass:</label>
<input type="password" name="password">
<button type="submit">Login</button>
</form>
</body>
</html>In the first form, clicking "Go" results in a URL like /search?q=html. In the second, the username and password are sent in the HTTP body, invisible in the address bar.
Common mistakes
- Using GET for login: Exposes credentials in history and logs. Always use POST for authentication.
- Assuming POST is secure: POST hides data from the URL but not from network sniffers. Use HTTPS for encryption.
- Modifying state with GET: If a GET link deletes a record, crawlers or prefetching might accidentally trigger it. Use POST for actions that change data.
- Ignoring length limits: Sending large datasets via GET will fail silently or truncate data due to URL length restrictions.
When to use it
| Feature | GET | POST |
|---|---|---|
| Data Location | URL Query String | Request Body |
| Visibility | Visible in Address Bar | Hidden from Address Bar |
| Cacheable | Yes | No (by default) |
| Bookmarkable | Yes | No |
| Primary Use | Reading/Searching | Creating/Updating |
Use GET when retrieving data without side effects (e.g., search results). Use POST when sending sensitive data or modifying server state (e.g., submitting a comment).
Practice
Guided Exercise: Create a simple HTML page with two forms. One searches for a product name using GET. The other submits feedback using POST. Observe the URL after submitting each.
Challenge: Why would you not use POST for a public API endpoint that returns weather data? Hint: Consider caching and bookmarkability.
Quick check
Question: If you need to share a link to a specific search result with a friend, which method should the search form use?
Answer: GET, because the search parameters are included in the URL, making the link shareable and bookmarkable.
Summary
GET is for reading data where visibility and caching are beneficial, while POST is for sending data securely or modifying server state. Choosing correctly ensures better security, performance, and user experience.