Should not use GET for Prepare Upload API method.

[dmitshur]

See section 9.1.2 of http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html:

Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request. The methods GET, HEAD, PUT and DELETE share this property.

Prepare Upload has side-effects and calling it multiple times should always return different output.

[dmitshur]

It is proposed to change it to POST instead.

[pavben]

Proposal accepted.

[pavben]

I propose the following details for the API change:

From:

GET /api/getfilename?ext=png

To:

POST /api/prepare_upload
...

original_filename=blah.tar.gz

... when uploading a file, or:

POST /api/prepare_upload
...

mime=image%2Fpng

... when uploading a screenshot from the clipboard.

I'm fine with making it a breaking change... we'll just update all clients along with the server.

[dmitshur]

Overall, SGTM.

Minor tweaks and suggestions. Web APIs tend to use dashes over underscores, so /api/prepare-upload maybe?

Do we really want to send the entire original filename instead of just file extension? The filename won't be used (just extension), and we're sending over HTTP so it may be leaked. Filename might contain sensitive information you don't want leaked. Therefore, it seems better to avoid sending something that's unneeded anyway.

Another suggestion, use "content-type" instead of "mime" as the parameter name. So, after suggest tweaks:

POST /api/prepare-upload
...

extension=.png

POST /api/prepare-upload
...

content-type=image/png

I'm fine with making it a breaking change... we'll just update all clients along with the server.

SGTM.

[pavben]

All of your suggestions above SGTM. One thing to discuss offline would be the filename vs extension. My reasoning was to keep it more general in case we want to avoid randomizing the filename, but that may be thinking too far into the future and we may never end up implementing this.

<InstantShare URL>/<random string>/<complete file name>

Personally, I do find myself sometimes wishing to have the ability to decorate the URL this way, specifically for any files I want people to save as opposed to just preview in the browser.