Key takeaways
- GET retrieves a resource and should never change server state.
- It is cacheable and idempotent, which is why it suits reads and not actions.
- Parameters ride in the URL, so never put secrets in a GET.
The HTTP “GET” method is used just for retrieving data and should have no other effect.
When you enter a URI in the browser or you click on a link you are executing a GET request. Here are some characteristics of GET requests: can be cached, bookmarked, appear in browser history.
You can easily find details about all the requests made, when accessing an URI, by opening the Developer Tools in the browser and inspecting the network traffic.
GET requests don’t necessarily have to be made from the browser, you can make AJAX GET requests and use other tools in this purpose.
Frequently Asked Questions
What is a GET request for?
Retrieving a resource. It should have no other effect, which is what lets browsers, proxies and caches treat it as safe to repeat.
Why does that matter in practice?
Because GET is cacheable and idempotent. Anything that changes state behind a GET can be repeated by a prefetch, a crawler or a retry without anyone intending it.
Can I put credentials in a GET?
No. Parameters ride in the URL, which ends up in browser history, server logs and referrer headers. Secrets belong in the body or a header.
