28

Look at this url:

http://stackoverflow.com/questions?sort=newest

This is the default url when browsing questions. It's normal. There are also other optional parameters:

pagesize - int, [1..50] - the number of records returned
page - the offset

Now. When you set the pagesize, for example to 13, such an url will be generated:

http://stackoverflow.com/questions?pagesize=13&sort=newest

But, when you change the page to a different one (the default is 1), you will get this:

http://stackoverflow.com/questions?page=2&sort=newest

Although the page is different now, the server somehow remembers that the user wants to see 13 records at a time. Does this mean that it is not a pure GET method? Is there some body beneath indicating the usage of a POST?

I assume that Stack Overflow is authoritative in terms of the design, that is why I would learn why such a design.

5
  • 1
    Anyway. I can't reproduce your case. When I navigate, the pagesize remains in the url. But that aside, information like that could easily be stored in cookies. Commonly not all that information is stored in the cookie itself, but only an identifier that leads to a session. The pagesize setting itself can be remembered on the server, als long as a session cookie remembers which session is yours.
    – GolezTrol
    Commented Jul 5, 2015 at 11:24
  • 19
    I'm a bit confused why this was migrated. Yes, it's asking about how SO does something, but it's asking from the point of view of why that is good design. Seems like it's a programming topic to me, not a meta topic.
    – Joe
    Commented Jul 6, 2015 at 21:28
  • 6
    Well that's a jump to judgement if I've ever heard one Commented Jul 6, 2015 at 22:11
  • 1
    If you reworded it to use Stack Overflow as one example I'm sure there wouldn't be such a knee-jerk reaction. There have been loads of posts that were meta posts being mis-filed on Stack Overflow, and at first glance your post certainly looks like it should have been asked on Meta instead. Your question certainly doesn't make it all that clear that you expected the site URLs to contain the full state, rather than also store state elsewhere.
    – Martijn Pieters Mod
    Commented Jul 7, 2015 at 10:36
  • Technically, GET differs from POST only by the name of the verb. Nothing restricts request handlers from persisting GET request parameters. In particular, this is how tracking pixels work. Commented Jul 8, 2015 at 9:44

4 Answers 4

33

You are right that it's not a pure GET request, because the site is not stateless. There are a lot of things going on, and a pure REST interface just isn't useful for an advanced web site. If every state would be sent back and forth in the URL, it would get very complicated and prone to errors.

A web page is not just a single resource. It usually contains a single resource as the main feature, but there are often other resources included in the page, for exampe lists of hot posts and related posts. There can even be list of posts from other sites in the network, so those are not even resources in the current site.

The site will remember some settings, like page size, but it will also remember a lot of other state. For example, if you start writing an answer, it will remember what you write even if you don't post it. If you close the question without posting, and then reopen it you still have your text that you wrote.

15
  • 9
    "it will remember what you write even if you don't post it. If you close the question without posting, and then reopen it you still have your text that you wrote." - I was very pleasantly surprised by this when earlier my PC crashed with a BSOD. After a restart I was able to carry on editing my question ;) Commented Jul 5, 2015 at 14:20
  • 13
    You're mixing a few things together here. Modern webpages are indeed complex, but a URI still identifies a single resource, where the hypermedia (and code on demand) then makes further requests to different URIs. The fact that the content shown when rendering a URI changes doesn't mean that what it identifies changes, but what it identifies may be defined relatively to the user logged in, for example.
    – Bruno
    Commented Jul 5, 2015 at 20:53
  • 3
    @Bruno: You are missing the point, and your description of modern web pages does not correspond to how actual web pages work. The REST paradigm just isn't sufficient to describe how the web works today.
    – Guffa
    Commented Jul 6, 2015 at 0:54
  • 4
    @Guffa I'd agree that the REST paradigm is more about guidelines than strict rules, but it still very much applies to modern webpages. Sure, there's nothing wrong about setting user preferences or some auxiliary settings (e.g. draft) when you visit a page, but you still get the GET on one resource (the page) guiding how interaction with other resources will happen. The resource where the draft is saved on this meta question is at http://meta.stackoverflow.com/posts/298600/editor-heartbeat/answer, for example (and sure, the definition of that resource is relative to the authenticated user).
    – Bruno
    Commented Jul 6, 2015 at 11:23
  • 3
  • 2
    @Bruno: Of course REST applies to web pages, the HTTP protocol is based on it, so you can't get away from it. The point is that modern web pages are too complex to be seen simply as REST interfaces.
    – Guffa
    Commented Jul 6, 2015 at 15:03
  • Why do you say "a pure REST interface just isn't useful for an advanced web site"?
    – B Seven
    Commented Jul 6, 2015 at 16:53
  • 4
    @BSeven I think the statement is "stateless websites are not that common, and SO is definitely not the sample of stateless web site". Commented Jul 6, 2015 at 17:13
  • 2
    REST is grossly misunderstood by the majority of people I see using the term. I can think of only a handful of websites that are actually REST-compliant. Commented Jul 7, 2015 at 10:29
  • @LightnessRacesinOrbit can you share a few sample sites that are REST-compliant, pleas?
    – asgs
    Commented Jul 7, 2015 at 11:32
  • @asgs: Hey! You caught me in an exagerration :) I didn't want to sound too sensational... Commented Jul 7, 2015 at 11:55
  • @LightnessRacesinOrbit Alright :-) I was really looking for some real examples after reading the post DavidRR linked above.
    – asgs
    Commented Jul 7, 2015 at 12:06
  • @Guffa: "the HTTP protocol is based on REST"? I didn't know that. Can you post a reference? I was pretty sure that HTTP predated Fieldings dissertation. Commented Jul 8, 2015 at 2:30
  • @JohnSaunders: Well, which came first? Perhaps it's more accurate to say that HTTP is based on the idea of REST... "The REST architectural style was developed by W3C Technical Architecture Group (TAG) in parallel with HTTP 1.1" en.wikipedia.org/wiki/Representational_state_transfer
    – Guffa
    Commented Jul 8, 2015 at 8:06
  • @Guffa: I would suggest that we consider REST as starting with Fielding's dissertation, and I believe that HTTP 1.0 was already in the standardization process. The idea of HTTP was one of the inputs into Fielding's thoughts about REST. For instance, his thoughts on caching GET. Commented Jul 8, 2015 at 16:14
8

It is most likely that they are using a session variable to store the value of pagesize so that if it is not present in the GET params it will use the last known value in the query.

This is a pretty standard operating procedure especially in pagination requests. This is also how the system would know which page of your search results to return to if you clicked on a particular link to an article or product, etc.

In Lasso this code would look something like this:

//start session and add spaces for variables
session_start($session_name)
session_addvar($session_name, 'sv_sort')
session_addvar($session_name, 'sv_page')
session_addvar($session_name, 'sv_pagesize')

//initialise session vars if they don't exist
not var_defined('sv_sort') ? var(sv_sort = 'newest')
not var_defined('sv_page') ? var(sv_page = 1)
not var_defined('sv_pagesize') ? var(sv_pagesize = 10)

//test for request params to update session vars
web_request->param('sort')->asString->size ? $sv_sort = web_request->param('sort')->asString
web_request->param('page')->asString->size ? $sv_page = integer(web_request->param('page'))
web_request->param('pagesize')->asString->size ? $sv_pagesize = integer(web_request->param('pagesize'))

//perform search function with the session vars
local(questions = so_questions->search($sv_sort, $sv_page, $sv_pagesize)

// output results
with q in #questions do => {^
    <output individual question html>
^}

Now when I go to the /questions page, the "missing" variables are inserted. Also this means that when I return to /questions after reading one in detail I will return to the page I left from without the detail page needing to know anything about how I got there.

Here, of course I am assuming a type (class) called so_questions with a public method search(sort::string, page::integer, pagesize::integer) that will return an array of html blocks suitable for output.

Naturally this is a very stripped down example to give you the idea of how search result pages typically utilise session variables to "remember" user input.

5

It appears setting the page size is considered a "preference" and is remembered across sessions. I can pass 13 as a page size, and then subsequently any page I visit on meta.stackoverflow.com with a list of questions will have 13. I can even login via a incognito session and once logged in it will display 13 items. So it's clearly saving that somewhere with my account.

It is pretty common technique to consider certain choices as a long term preference. Where and when you do this depends alot on considering the user experience.

"Does this mean that it is not a pure GET method? Is there some body beneath indicating the usage of a POST?"

As far as I can tell, no, there is no header that is passing additional criteria, and nothing in a cookie holding those values, since those do not carry across to incognito. From my tests it's clearly being associated with the user account.

"why I would learn why such a design."

As mentioned, it's about improving user experience. Allowing the site to remember choices that the user is likely to prefer across the entire site. If I got to a shopping site I often choose to see 50 items at a time, and it would be really nice if the site remembered that. SO has chosen to make that something that is remembered across site visits.

3

I assume that Stack Overflow is authoritative in terms of the design, that is why I would learn why such a design.

Stack Exchange has great developers, but no single software project is going to be entirely authoritative in terms of design. Resources are always limited, and time that could be spent polishing one thing to perfection is often better spent getting a new thing working at all.

You may or may not want to copy this particular aspect of their design. They're changing your persistent setting based on an unauthenticated GET parameter. This makes it trivial for another user to change your settings using cross-site request forgery (CSRF).

For example, if I simply included <img src="http://meta.stackoverflow.com/?pagesize=1"> in this post, your Meta Stack Overflow page size setting would now be 1.

You should never use approach for any setting where changing it could affect the security of your users, or annoy them too badly. Those settings must be protected using a CSRF prevention technique such as a secret token. (Just using POST does make certain abuses more difficult, but it won't entirely protect you.)

4
  • Could you expand on "unauthenticated GET parameter"? How would you "authenticate" GET?
    – nico
    Commented Jul 8, 2015 at 9:42
  • 2
    @nico I just meant that you could include a CSRF token (or a more advanced signature) in a GET request to verify that it's genuine, just like you would for POST. But for most sites, where GET requests have no side effects, there would rarely be any reason to do this.
    – Jeremy Banks Mod
    Commented Jul 8, 2015 at 9:50
  • Ok, makes sense
    – nico
    Commented Jul 8, 2015 at 9:52
  • Hehe: meta.stackoverflow.com/q/298861/17034 Commented Jul 9, 2015 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .