One thing that has always struck me as odd is the Store (the class responsible for fetching and exposing the data) defaults to a HTTP POST when retrieving data. I think that any retrieval of data from an HTTP end point should be GET, to take advantage of caching and the simple fact that the operation is idempotent.
If you want to force a HTTP GET method to be used when retrieving data with an Ext JS Store (for instance, when retrieving JSON data), here's the Javascript code:
var proxy = new Ext.data.HttpProxy({
url: '/foos.json',
method: 'GET'
});
var store = new Ext.data.Store({
remoteSort: true,
proxy: proxy,
sortInfo: {field: 'id', direction:'desc'},
reader: new Ext.data.JsonReader({
fields: [{name:'id', type:'number'},
{name:"created_at", type: 'date', dateFormat: Date.patterns.XmlSchema},
"category_value",
"sub_category_value",
"created_by_login",
"involved_people_count",
"involved_objects_count",
"percent_complete"],
totalProperty: 'totalRecords',
root: 'records'
})
});
Notice the external HttpProxy which defines the URI that returns the JSON data as well as the HTTP method. Pass this HttpProxy to the Store and you'll be using GET!
6 comments:
Probably the reason the thing defaults to POST (presuming that it is not read-only) is that if you default to GET and people use it to write/modify data without paying attention to the method used, then you are violating the HTTP principle that GET should be a ‘safe method’, which in turn can result in a nasty security vulnerability.
Sure, GET is primarily for retrieving representations (a.k.a. Reading) The DataGrid and related Store objects are arguably only used for reading/viewing information. Therefore, I would have expected that the default method is GET. But you're right, if you are changing data, you should use PUT, POST, or DELETE.
hi...
Not enought information...
maegozpt twqpmlvef qhrvpatc czvy vxlzfg mcbg zoysrvi
maegozpt twqpmlvef qhrvpatc czvy vxlzfg mcbg zoysrvi
Probably the reason the thing defaults to POST (presuming that it is not read-only) is that if you default to GET and people use it to write/modify data without paying attention to the method used, then you are violating the HTTP principle that GET should be a ‘safe method’, which in turn can result in a nasty security vulnerability.
Post a Comment