Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

Review Suggested Edit

You can't approve or reject suggested edits because you haven't yet earned the Edit Posts ability.

Dealing with GETs with long query strings in ASP.NET Core

[]()One of the recent business requirements is to be able to search through a list of entities using a bunch of filters. Most of these filters allow multiple values and the user might theoretically provide more than 100 selected filter values (some of the filters are even implemented as tree views due to the rather large number of items).
Under normal circumstances, I would define a GET endpoint which "binds" all filter values and does its job. However, this means that a query string might be very long:
```
/api/entities/list?param1=val1&param1=val2.... &param1=val10&param2=val11&....
```
This [Q&A](https://stackoverflow.com/questions/812925/what-is-the-maximum-possible-length-of-a-query-string) provides the query string limits for various browsers and most of them seem to be at least in the tens of KB (of characters).
This should be enough for me (the application is used only in Chrome and Firefox), but there seem [to be security and performance implications] (https://stackoverflow.com/a/48230425/2780791) that lead to 2K as the recommended limit.
A quick option would be to go against the REST "purity" and replace the GET with a POST and the limit would not matter. An alternative would be using GET with a body, but [this is not recommended](https://stackoverflow.com/a/983458/2780791) either.
**I am wondering if there is a guideline related to how to proceed in such cases.**
For my particular case, since the API method is consumed only by a SPA developed by the same team, I can virtually take any approach:
- I will not hit the limits of the browser
- The normal scenario involves an AJAX call with the long query string (from SPA or SwaggerDocs), not necessarily to work in the browser
- I can change [some hosting server limits](https://social.msdn.microsoft.com/Forums/en-US/b1965c18-fe8f-40ca-9e68-d1b5b3d364c0/get-with-large-query-data?forum=aspwebapi) if I need to
- I am not actually forced to use REST API guidelines (although I would really like to develop use non-standard implementations)

One of the recent business requirements is to be able to search through a list of entities using a bunch of filters. Most of these filters allow multiple values and the user might theoretically provide more than 100 selected filter values (some of the filters are even implemented as tree views due to the rather large number of items).
Under normal circumstances, I would define a GET endpoint which "binds" all filter values and does its job. However, this means that a query string might be very long:
```
/api/entities/list?param1=val1&param1=val2.... &param1=val10&param2=val11&....
```
This [Q&A](https://stackoverflow.com/questions/812925/what-is-the-maximum-possible-length-of-a-query-string) provides the query string limits for various browsers and most of them seem to be at least in the tens of KB (of characters).
This should be enough for me (the application is used only in Chrome and Firefox), but there seem [to be security and performance implications](https://stackoverflow.com/a/48230425/2780791) that lead to 2K as the recommended limit.
A quick option would be to go against the REST "purity" and replace the GET with a POST and the limit would not matter. An alternative would be using GET with a body, but [this is not recommended](https://stackoverflow.com/a/983458/2780791) either.
**I am wondering if there is a guideline related to how to proceed in such cases.**
For my particular case, since the API method is consumed only by a SPA developed by the same team, I can virtually take any approach:
- I will not hit the limits of the browser
- The normal scenario involves an AJAX call with the long query string (from SPA or SwaggerDocs), not necessarily to work in the browser
- I can change [some hosting server limits](https://social.msdn.microsoft.com/Forums/en-US/b1965c18-fe8f-40ca-9e68-d1b5b3d364c0/get-with-large-query-data?forum=aspwebapi) if I need to
- I am not actually forced to use REST API guidelines (although I would really like to develop use non-standard implementations)

rest query-string get

Communities

Review Suggested Edit