Subject: POST with empty body

From: "Darrel Miller" <[email-masked]>
Date: Thu, 02 Sep 2010 00:31:15 +0000

In the description of POST here [1], it starts with:

"The POST method is used to request that the origin server accept the
representation enclosed in the request as data to be processed by the
target resource."

This seems to infer that it is expected that a POST include a body.  Is it
required to have a body?  Is it unreasonable to expect a client to issue 

POST http://example.org/tokens

...and expect a token to be created, despite the fact that no representation
is passed to the origin server?

Taking this a step further, is the use of query string parameters instead of
a post body considered a valid request.  Could a client make the following
request?

POST http://mapservice.org/Waypoints?latitude=51&longiitude=114

I realize this is not a common usage, but my question is whether this is
prohibited by the HTTP specification, whether it is discouraged due to
negative impacts, or whether it a reasonable usage that is just not clear
from the description of POST.

Thanks for your time,

Darrel Miller

[1] http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-11#page-17

---

From: David Morris <[email-masked]>
Date: Thu, 2 Sep 2010 13:49:01 -0700 (PDT)

> is passed to the origin server?

Nothing is said in the description of POST re. creating anything. It says
"processed by the target resource". I can't conceive of why an empty
body would be an error. It is up to the processing resource to make that
determnation, not the HTTP protocol.

> POST http://mapservice.org/Waypoints?latitude=51&longiitude=114

Perhaps not common usage when combined with an empty body, but from a
protocol perspective, the query string parameters are just part of
the URL. I've worked with a number of platforms over the years which
make it easy to just treat query string name value pairs and name
value pairs in the POST body as a single name space such that the
resource processing logic author need not care how the values were
transported.

In some cases, I had to look hard to determine how a value was
transported.

But I don't see any protocol issue with the above URL.

---

From: Jan Algermissen <[email-masked]>
Date: Thu, 02 Sep 2010 23:14:22 +0200

>> representation enclosed in the request as data to be processed by the

Wouldn't an empty POST body make the above equivalent to 'do something'? And wouldn't that equate to method tunneling?
(along the lines of POST [empty] to /orders/42/ship )

Isn't the body what prevents the semantic of the target resource to be a function of the state of some other resource?
(In the example, the semantic of /orders/42/ship would depend on the state of /orders/42)

[Sorry for maybe going way-off here]

Jan

---

From: Willy Tarreau <[email-masked]>
Date: Thu, 2 Sep 2010 23:30:33 +0200

> (along the lines of POST [empty] to /orders/42/ship )

According to p1-11 page 23 :
   5.  If this is a request message and none of the above are true, then
       the message-body length is zero (no message-body is present).

so a POST with no content-length and no body is equivalent to a POST
with Content-Length: 0 and nothing following, as could perfectly happen
when you upload an empty file for instance. The resource is determined
by the URL and the server has to know how to handle the body, including
if it's empty. I don't see the issue here in fact :-/

Willy

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 3 Sep 2010 11:00:06 +1000

It's important to note that a message without a body can still carry a representation, because a representation is the combination of the body (which can be zero-length) *and* headers.

See:
  http://tools.ietf.org/html/draft-ietf-httpbis-p3-payload-11#section-4

Cheers,

--
Mark Nottingham     http://www.mnot.net/

---

From: Nathan <[email-masked]>
Date: Fri, 03 Sep 2010 13:38:42 +0100

Is there any chance of a slight clarification to zero-body POST, message 
in URI?

Specifically I'm thinking that for years the message of don't do things 
like 'GET /transfer-funds?account=1234&to=4567&amount=100000000' has 
been common, whereas this seems to indicate that simply swapping the 
verb to POST makes it 'okay' (please do infer the human readable meaning 
of the example conveyed by the URI).

I guess (personally) I have a gut feeling that this could create 
problems somewhere down the line - but the specifics of how and what 
escape me for the time being.

Best,

Nathan

---

From: Henrik Nordström <[email-masked]>
Date: Sun, 05 Sep 2010 23:31:29 +0200

> escape me for the time being.

There is applications that insists on an entity-body being present in
POST requests even if length 0.

Regards
Henrik