0x00 前言

哇~~ 又有好長(zhǎng)一算時(shí)間沒有發(fā)過文章了，被罵了尔许，╥﹏╥... 蜈彼。別打我剖淀，我回到正題還不行嘛。

首先介汹，我們先來(lái)了解一下HTTP請(qǐng)求方法共有多少種却嗡。HTTP1.0定義了三種請(qǐng)求方法：GET，POST嘹承，HEAD窗价。HTTP1.1在對(duì)原有的HTTP1.0兼容的情況下做了一些改進(jìn)，并新增了五種請(qǐng)求方法：OPTIONS赶撰，PUT舌镶，DELETE柱彻，TRACE和CONNECT。(PS: 我才不會(huì)告訴你餐胀，新增的方法中 PUT 和 DELETE 在部分服務(wù)器上不合理的設(shè)置是可以被用來(lái)攻擊的)

來(lái)張表更清晰的看一下哟楷。

這里我就主要講一下這里面最常用的兩種方法扣汪，GET 和 POST断楷。

0x01 GET 請(qǐng)求方法

摘自 參考文檔1

The GET method means retrieve whatever information (in the form of an entity) is identified by the Request-URI. If the Request-URI refers to a data-producing process, it is the produced data which shall be returned as the entity in the response and not the source text of the process, unless that text happens to be the output of the process.

The semantics of the GET method change to a "conditional GET" if the request message includes an If-Modified-Since, If-Unmodified-Since, If-Match, If-None-Match, or If-Range header field. A conditional GET method requests that the entity be transferred only under the circumstances described by the conditional header field(s). The conditional GET method is intended to reduce unnecessary network usage by allowing cached entities to be refreshed without requiring multiple requests or transferring data already held by the client.

The semantics of the GET method change to a "partial GET" if the request message includes a Range header field. A partial GET requests that only part of the entity be transferred. The partial GET method is intended to reduce unnecessary network usage by allowing partially-retrieved entities to be completed without transferring data already held by the client.

The response to a GET request is cacheable if and only if it meets the requirements for HTTP caching described in section 13.

/test.php
/test.php?name1=value1&name2=value2

上面的兩種通常都是 GET 請(qǐng)求(PS: 在 POST 的請(qǐng)求同時(shí)是可以包含GET請(qǐng)求內(nèi)容。)崭别，可以看出冬筒，如果 GET 想攜帶參數(shù)發(fā)出請(qǐng)求的話，使用?后面接參數(shù)名=參數(shù)值即可茅主。

需要注意的是

• GET 請(qǐng)求可被緩存
• GET 請(qǐng)求保留在瀏覽器歷史記錄中
• GET 請(qǐng)求可被收藏為書簽
• GET 請(qǐng)求不應(yīng)在處理敏感數(shù)據(jù)時(shí)使用(PS: 嘗試把賬號(hào)密碼 GET 請(qǐng)求一下舞痰？[壞笑])
• GET 請(qǐng)求有長(zhǎng)度限制，通常認(rèn)為是2083字符長(zhǎng)度

其實(shí)我們最常用的就是 GET 請(qǐng)求了呢诀姚。再說另一個(gè)最常用的請(qǐng)求--POST

0x03 POST 請(qǐng)求方法

The POST method is used to request that the origin server accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the Request-Line. POST is designed to allow a uniform method to cover the following functions:

The actual function performed by the POST method is determined by the server and is usually dependent on the Request-URI. The posted entity is subordinate to that URI in the same way that a file is subordinate to a directory containing it, a news article is subordinate to a newsgroup to which it is posted, or a record is subordinate to a database.

The action performed by the POST method might not result in a resource that can be identified by a URI. In this case, either 200 (OK) or 204 (No Content) is the appropriate response status, depending on whether or not the response includes an entity that describes the result.

If a resource has been created on the origin server, the response SHOULD be 201 (Created) and contain an entity which describes the status of the request and refers to the new resource, and a Location header.

Responses to this method are not cacheable, unless the response includes appropriate Cache-Control or Expires header fields. However, the 303 response can be used to direct the user agent to retrieve a cacheable resource.

POST /demo/post.php HTTP/1.1
Host: soudou.net.cn
name1=value1&name2=value2

POST 的請(qǐng)求內(nèi)容在URI中不做體現(xiàn)响牛，具體是在請(qǐng)求體中存在鍵值對(duì)的對(duì)應(yīng)。

再說一個(gè)需要注意：

• POST 請(qǐng)求不會(huì)被緩存
• POST 請(qǐng)求不會(huì)保留在瀏覽器歷史記錄中
• POST 不能被收藏為書簽
• POST 請(qǐng)求對(duì)數(shù)據(jù)長(zhǎng)度沒有要求(PS: 請(qǐng)求內(nèi)容太大的話赫段，還是分開比較好呀打，不然真的會(huì)炸的)

再?gòu)U話幾句，POST 請(qǐng)求方式里面其實(shí)也是有很多差異的說瑞佩。我們常見的有四種 POST 請(qǐng)求方式：application/x-www-form-urlencoded聚磺，multipart/form-data，application/json炬丸，text/xml。這四種應(yīng)用的領(lǐng)域也都不盡相同蜒蕾。下面來(lái)簡(jiǎn)單說一下稠炬。

0x03.1 application/x-www-form-urlencoded

這大概就是 POST 中最常用的提交數(shù)據(jù)的方式之一了。瀏覽器的原生 <form> 表單咪啡，不設(shè)置 enctype 屬性首启，那么就會(huì)以 application/x-www-form-urlencoded 方式提交數(shù)據(jù)。請(qǐng)求類似于下面這樣：

POST /demo/post.php HTTP/1.1
Host: soudou.net.cn
Content-Type: application/x-www-form-urlencoded;charset=utf-8

name1=value1&name2=value2

首先撤摸，Content-Type 被指定為 application/x-www-form-urlencoded毅桃；其次褒纲，提交的數(shù)據(jù)按照name1=value1&name2=value2的方式進(jìn)行編碼，name 和 value都進(jìn)行了 URL 轉(zhuǎn)碼钥飞。

很多時(shí)候莺掠，我們用 Ajax 提交數(shù)據(jù)時(shí)，也是使用這種方式读宙。例如 JQuery 的 Ajax彻秆，Content-Type 默認(rèn)值就是 application/x-www-form-urlencoded;charset=utf-8。

0x03.2 multipart/form-data

這是另一個(gè)常見的 POST 數(shù)據(jù)提交的方式结闸。我們使用這種方式上傳文件時(shí)唇兑，必須讓 <form> 表單的 enctype 等于 multipart/form-data。直接來(lái)看一個(gè)請(qǐng)求示例：

POST /demo/post.php HTTP/1.1
Host: soudou.net.cn
Content-Type:multipart/form-data; boundary=----dddddddddddddddddddd

------dddddddddddddddddddd
Content-Disposition: form-data; name="text"

title
------dddddddddddddddddddd
Content-Disposition: form-data; name="file"; filename="demo.png"
Content-Type: image/png

base64...
------dddddddddddddddddddd--

這種方式首先會(huì)生成了一個(gè) boundary 用于分割不同的字段桦锄，為了避免與提交的內(nèi)容重復(fù)扎附，boundary 通常會(huì)很長(zhǎng)很復(fù)雜。然后 Content-Type 里指明了數(shù)據(jù)是以 multipart/form-data 來(lái)編碼结耀，本次請(qǐng)求的 boundary 是什么內(nèi)容留夜。消息主體里按照字段個(gè)數(shù)又分為多個(gè)結(jié)構(gòu)類似的部分，每部分都是以 --boundary 開始饼记，緊接著是內(nèi)容描述信息香伴，然后是回車，最后是字段具體內(nèi)容（文本或二進(jìn)制）具则。如果傳輸?shù)氖俏募锤伲€要包含文件名和文件類型信息。消息主體最后以 --boundary-- 標(biāo)示結(jié)束博肋。關(guān)于 multipart/form-data 的詳細(xì)定義低斋，可以前往 rfc1867 查看。

這種方式通常被用來(lái)上傳文件匪凡。

0x03.3 application/json

這種方案膊畴，通常用于提交復(fù)雜的結(jié)構(gòu)化數(shù)據(jù)，特別適合 RESTful 的接口病游。各大抓包工具如 Chrome Developer Tools唇跨、Firefox Developer Tools、Charles衬衬，都會(huì)以樹形結(jié)構(gòu)展示 JSON 數(shù)據(jù)买猖，非常友好。但有些服務(wù)端語(yǔ)言還沒有支持這種方式滋尉，例如 php 就無(wú)法通過 $_POST 對(duì)象從上面的請(qǐng)求中獲得內(nèi)容玉控。這時(shí)候，需要自己動(dòng)手處理下：在請(qǐng)求頭中 Content-Type 為 application/json 時(shí)狮惜，從 php://input 里獲得原始輸入流高诺，再 json_decode 成對(duì)象碌识。一些 php 框架已經(jīng)開始這么做了。

0x03.4 text/xml

它是一種使用 HTTP 作為傳輸協(xié)議虱而，XML 作為編碼方式的遠(yuǎn)程調(diào)用規(guī)范筏餐。(唔，開發(fā)者你開心就好薛窥，反正我是不會(huì)用的胖烛，據(jù)說某些支付系統(tǒng)的數(shù)據(jù)傳輸用的就是這個(gè))

0x04 后記

超生氣

給錢

如果幫到了你就點(diǎn)個(gè)贊打個(gè)賞吧佩番，我才不會(huì)謝謝你。

參考文檔

1. HTTP/1.1: Method Definitions
2. HTTP 方法：GET 對(duì)比 POST
3. 四種常見的 POST 提交數(shù)據(jù)方式