web applications – Email Confirmation links must be GET, but not safe – Software Engineering Stack Exchange

web applications – Email Confirmation links must be GET, but not safe – Software Engineering Stack Exchange

When a user signs up to a web app, they often get a confirmation email. This email will contain a link. Once the user clicks the link, the app confirms the user’s account as correctly associated with said email, perhaps by changing a confirmed field on the user document from false to true.

My question:

Don’t these two facts violate HTTP standards? GET requests are supposed to be safe. So PATCH seems more appropriate for changing the confirmed field. However, there is no way to make a link in an email a PATCH request.

How do software engineers handle this inconsistency? Is it just a violation that’s accepted? Or is there a correct way to implement this so that we don’t violate HTTP standards.

*An HTTP method is safe if it doesn’t alter the state of the server. source

This content was originally published here.

Leave a Reply

%d bloggers like this: