C# HTTP Methods: Safe vs. Unsafe, GET vs. POST in .NET Core

Before reading this article, please read the previous articles so that you can understand Optimize HttpClient Usage in .NET Core. The link to the previous article is provided: Optimize HttpClient Usage in .NET Core (c-sharpcorner.com)

Dot net core

In C#, HTTP methods are classified as safe or unsafe based on how they interact with the server's state, not necessarily on inherent security.

Safe HTTP Methods

GET: Retrieves data from the server. Considered safe because it doesn't modify server data and is generally used for reading existing resources.
HEAD: Similar to GET, retrieves header information about a resource without transferring the actual content. Safe as it doesn't alter the server state.
OPTIONS: Queries the server about the communication options supported by the resource. Safe as it just retrieves information.

Unsafe HTTP Methods

POST: Often used to submit data to create or update resources on the server. It is unsafe because it can potentially modify the server state.
PUT: Used to update an entire resource on the server. Unsafe as it modifies the server's data.
DELETE: Used to remove a resource from the server. It is unsafe as it deletes data and alters the server state.
PATCH: Used to partially update a resource on the server. Unsafe as it modifies a portion of the server's data.

Note

Safety vs. Security: These classifications are about modifying server state, not inherent security. Even safe methods can be misused for security vulnerabilities. Always prioritize HTTPS for secure communication regardless of the HTTP method used.

Choice of the Right Method

Use safe methods (GET, HEAD, OPTIONS) for retrieving data or querying capabilities without unintended side effects.
Use unsafe methods (POST, PUT, DELETE, PATCH) with caution, ensuring proper authorization and validation for any actions that modify server data.

GET VS POST

Neither GET nor POST are inherently secure in C# by themselves, but POST offers some advantages in terms of keeping data confidential,

Data Visibility
- GET requests include data in the URL, which is visible in browser history and server logs. This can be a security risk for sensitive information.
- POST requests send data in the message body, hidden from the URL.
- However, both GET and POST data are equally exposed during transmission between client and server unless you use HTTPS (Hypertext Transfer Protocol Secure). HTTPS encrypts the entire communication, including the request method (GET or POST), data, and headers.
Use HTTPS for True Security
- For sensitive data transmission, regardless of GET or POST, prioritize HTTPS. It ensures data confidentiality during transfer.

Choose the Right Method for Data Sensitivity

Use GET for publicly retrievable data (e.g., search parameters) where confidentiality isn't critical.
Use POST for sensitive data (e.g., login credentials) to avoid exposing it in the URL.

For secure data exchange in C#, HTTPS is essential. Beyond that, POST offers some advantages in terms of data confidentiality compared to GET, but remember, it doesn't guarantee security on its own.

Using HttpClient Vs. IHttpClientFactory In .NET Core For Making HTTP Requests:

HttpClient

Simple Usage: Easy to create directly using new HttpClient().
Manual Management: You're responsible for managing the lifecycle of the HttpClient instance, including connection pooling and disposal.
Limited configurability: Less flexibility in configuring settings like base address, timeouts, and message handlers.
Potential Issues: This can lead to issues like socket exhaustion and difficulty with dependency injection in complex applications.

IHttpClientFactory

Preferred Approach: Generally recommended by Microsoft for most scenarios.
Dependency Injection: Integrates well with dependency injection (DI) frameworks for cleaner code and better testability.
Lifetime Management: Manages the lifetime of HttpClient instances, including connection pooling and disposal.
Configurability: Offers more control over configuration, allowing you to create named clients with specific settings for different APIs.

Resiliency: Facilitates integration with libraries like Polly for implementing retry logic and fault tolerance in your HTTP calls.

Feature	HttpClient	IHttpClientFactory
Usage	Simple, create directly with new HttpClient()	Preferred, integrates with DI
Management	Manual	Automatic lifecycle management
Configuration	Limited	More flexible, named clients with custom settings
DI	No direct integration	Integrates well with DI frameworks
Resiliency	Limited	Facilitates integration with Polly for fault tolerance

When to Use Which One

Simple Applications: For basic scenarios with a single API or limited configuration needs, HttpClient might suffice.
Most Cases: For most .NET Core applications, especially those growing in complexity, IHttpClientFactory is the recommended approach due to its benefits in maintainability, scalability, and testability.

Example

How to use IHttpClientFactory for various HTTP methods (GET, POST, PUT, PATCH, DELETE) in C#

1. Dependency Injection Setup

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddHttpClient("CSharpNamedClient", c =>
{
    c.BaseAddress = new Uri("API URL");
    c.Timeout = TimeSpan.FromMinutes(1);
    c.DefaultRequestHeaders.Add("Accept", "application/json");
    c.DefaultRequestHeaders.Add("AuthKey", "");
});

Explained: Add a Named HttpClient in Application Startup, With required options as per business case. Base Address will help to define the API URL to communicate and Using Default Request Headers will help to add each request Http Header Properties.

private readonly IHttpClientFactory _httpClientFactory;

public MyServiceController(IHttpClientFactory clientFactory)
{
    _httpClientFactory = clientFactory;
}

Explained: Via DI, We will get the HttpClient object and access our named client.

2. GET Request

public async Task<CustomResponseBO> GetAsync(string url)
{
    var client = _httpClientFactory.CreateClient("CSharpNamedClient"); // Replace with your client name
    var response = await client.GetAsync(url);
    var isSuccess = response.EnsureSuccessStatusCode(); 
    return await response.Content.ReadFromJsonAsync<CustomResponseBO>();
}

Explained: This method creates a named client ("CSharpNamedClient") using the factory and performs a GET request to the specified URL. It then deserializes the response content into the desired type (CustomResponseBO).

3. POST Request

public async Task<ResponseBO> PostAsync(RequestBO data)
{
    var client = _httpClientFactory.CreateClient("CSharpNamedClient");
    var content = new StringContent(JsonConvert.SerializeObject(data), Encoding.UTF8, "application/json");
    var response = await client.PostAsync(url, content);
    return await response.Content.ReadFromJsonAsync<ResponseBO>();
}

Explained: This method creates a named client and sends a POST request with the provided data (RequestBO) serialized as JSON content. It then deserializes the response into the desired type (ResponseBO).

4. PUT Request

public async Task PutAsync(RequestBO data)
{
    var client = _httpClientFactory.CreateClient("CSharpNamedClient");
    var content = new StringContent(JsonConvert.SerializeObject(data), Encoding.UTF8, "application/json");
    await client.PutAsync("", content);
}

Explained: This method creates a named client and performs a PUT request with the provided data (RequestBO) serialized as JSON content. Note that it doesn't return a response object, as PUT usually doesn't expect one.

5. PATCH Request

public async Task PatchAsync(RequestBO data)
{
    var client = _httpClientFactory.CreateClient("CSharpNamedClient");
    var content = new StringContent(JsonConvert.SerializeObject(data), Encoding.UTF8, "application/json");
    var request = new HttpRequestMessage(HttpMethod.Patch, "") { Content = content };
    await client.SendAsync(request);
}

Explained: This method creates a named client, prepares a PATCH request with the data (RequestBO) serialized as JSON content, and sends it using SendAsync. Similar to PUT, it doesn't return a response object.

6. DELETE Request

public async Task DeleteAsync(string id)
{
    var client = _httpClientFactory.CreateClient("CSharpNamedClient");
    await client.DeleteAsync(id);
}

Explained: This method creates a named client and sends a DELETE request to the specified ID. It doesn't expect a response or data.

Thanks.