HTTP GET with Request body – Guidelines

If you are reading this article, then I think you are looking at the possible use case of using HTTP GET with request body parameters.

Similar guidelines discussed here can be used as a reference for HTTP idempotent methods like DELETE methods also.

We will cover below a few aspects in the article,

There could be multiple legitimate use cases for this in your case. But for me recently I needed to send very large input using the GET method and wanted to verify if I can send large input with body parameters.

These limitations are more found on the server side and it is possible that some servers might just ignore the body of GET requests or behavior like caching GET requests might cause issues.

So in order to solve the issue, I looked at options like sending body parameters within the GET method.

I was stuck with this issue and I had to do a lot of analysis on finding the best resolutions.

I found that due to limitations on URI max length GET method can not be used for sending large input data either through putting details in URI directly or using the query parameter within the URL.

RFC Specification

As per RFC 7231 below are guidelines for rest get with the body,

GET is the primary mechanism of information retrieval and the focus of almost all performance optimizations.

A payload within a GET request message has no defined semantics; sending a payload body on a GET request might cause some existing implementations to reject the request.

Specification and What it meant to us?

Specification clarifies the support for the GET method with body parameters. But please note that it also warns us of its usage.

So if the length of parameters is longer and the server indeed receives the data from the body that supports it then you should be good to follow these specifications.

You must also validate other Test tools supporting it like Postman, Swagger, and Soap UI etc.

But, I wanted to see a more legitimate reason for not sending Body parameters in GET.

Below are a few major limitations and guidelines elaborating to use or not to use HTTP GET or DELETE method with body parameters.

Below are a few examples with some guidelines which can help you decide to opt IN/OUT of this support in your APIs.

GET support Body in .NET Core

After following the above specifications, I validated the .NET Core support for GET method with the Body parameter.

GET method was successful with [FromBody] parameters proving .NET Core has already added support in accordance with the specification.

Please see the below implementation,

        [AllowAnonymous]
        [HttpGet]
        public IActionResult Token([FromBody]LoginModel login)
        {
            
            return Ok(login.Username);
        }

Here is the Client-side code to execute the GET method with Body,

        var request = new HttpRequestMessage
            {
                Method = HttpMethod.Get,
                RequestUri = new Uri("https://localhost:44341/api/auth"),
                Content = new StringContent(json, Encoding.UTF8, "application/json")
            };

Please see here for a complete sample code for GET and DELETE requests.

GET doesn’t support Body in .NET Framework

GET doesn’t support Body in .NET Framework and gives the below error,

"Cannot send a content-body with this verb-type."

Using Fiddler – Warning for GET

Fiddler warns you but allows us to send the body and the operation runs successfully.

SOAP UI – No support

I don’t find support exists for sending body parameters with GET method using SOAP UI.

PostMan UI- Support

The recent version has added support for sending body parameters with GET method using POSTMan UI.

Using Swagger – No support

Swagger Open API documentation gives the below error for GET method,

"Failed to execute 'fetch' on Windows. Request with GET/HEAD method can not have the body".

Swagger gives the below error for DELETE method,

 "DELETE operations cannot have a request Body"

Server Configuration issues

• A lot of servers cache the responses to GET and HEAD requests. This behavior might cause issues.

• It’s also possible that the Server might just ignore the body of GET request.

Proxy Issues

Please be cautious that proxies might break your request in various ways if the body is included in GET method.

A few other reasons alarming us to not use GET with Body are as below,

• Amazon CloudFront doesn’t support GET with the Body parameter.
• Sping-framework doesn’t support GET with the body.
• XMLHttpRequest doesn’t support GET with the body.
• Most Javascript libraries don’t support GET with a body.

Few examples where GET with the body is supported,

• Elastic search support GET with body parameters. (This is the only example, I found in the support.)
• Recent .NET Core framework-based application support GET with body

Other useful references:

• RFC 2616: https://tools.ietf.org/html/rfc2616#section-4.3

• RESTFul API URL Route Naming conventions and guidelines

Summary

Today in this article we looked at HTTP GET support for body parameters. Although the specification clarifies support for GET method with body parameters, it also warns us about its usage and clarifies that it is not useful to do so. We looked at multiple aspects of using GET with body parameters including Tools and Testing support with its pros and cons etc.

Do you have any comments or ideas or any better suggestions to share?

Please sound off your comments below.

Happy Coding !!

---

Please bookmark this page and share it with your friends. Please Subscribe to the blog to receive notifications on freshly published(2024) best practices and guidelines for software design and development.

---