HTTP Methods: GET vs POST
The two most commonly used HTTP methods are: GET and POST.
What is HTTP?
The Hypertext Transfer Protocol (HTTP) is designed to enable communications between clients and servers.
HTTP works as a request-response protocol between a client and server.
A web browser may be the client, and an application on a computer that hosts a website may be the server.
Example: A client (browser) sends an HTTP request to the server; then the server returns a response to the client. The response contains status information about the request and may also contain the requested content.
Two HTTP Request Methods: GET and POST
When a client and server communicate, the two most commonly used methods are: GET and POST.
- GET - Requests data from a specified resource.
- POST - Submits data to be processed to a specified resource.
GET parameters are typically displayed in the URL, while POST parameters are submitted via a form and are not displayed in the URL. POST is more secure:
GET Method
Note that the query string (name/value pairs) is sent in the URL of a GET request:
Other notes about GET requests:
- GET requests can be cached
- GET requests remain in the browser history
- GET requests can be bookmarked
- GET requests should not be used when dealing with sensitive data
- GET requests have length restrictions
- GET requests should only be used to retrieve data
POST Method
Note that the query string (name/value pairs) is sent in the HTTP message body of a POST request:
Other notes about POST requests:
- POST requests are not cached
- POST requests do not remain in the browser history
- POST requests cannot be bookmarked
- POST requests have no restrictions on data length
Comparison between GET and POST
The following table compares the two HTTP methods: GET and POST.
GET | POST | |
---|---|---|
Back button/Reload | Harmless | Data will be re-submitted (the browser should alert the user that data are about to be re-submitted). |
Bookmark | Can be bookmarked | Cannot be bookmarked |
Cache | Can be cached | Cannot be cached |
Encoding type | application/x-www-form-urlencoded | application/x-www-form-urlencoded or multipart/form-data. Use multipart encoding for binary data. |
History | Parameters remain in browser history. | Parameters are not saved in browser history. |
Restrictions on data length | Yes. When sending data, GET adds data to the URL; the length of a URL is limited (maximum length of URL is 2048 characters). | No restrictions. |
Restrictions on data type | Only ASCII characters allowed. | No restrictions. Allows binary data. |
Security | GET is less secure compared to POST because data sent is part of the URL. <br> <br>Never use GET when sending passwords or other sensitive information! | POST is more secure than GET because parameters are not stored in browser history or in web server logs. |
Visibility | Data is visible to everyone in the URL. | Data is not displayed in the URL. |
Other HTTP Request Methods
The following table lists some other HTTP request methods:
Method | Description |
---|---|
HEAD | Same as GET but returns only HTTP headers and no document body. |
PUT | Uploads a representation of the specified URI. |
DELETE | Deletes the specified resource. |
OPTIONS | Returns the HTTP methods that the server supports. |
CONNECT | Converts the request connection to a transparent TCP/IP tunnel. |