HTTP verb: POST
This course covers the HTTP POST method, used to send new data to a server. It explains why POST is neither safe nor idempotent, how the request body and the Content-Type header carry data, and what the server sends back, including 201 Created, the Location header and the Post/Redirect/Get pattern. It shows HTML forms, file uploads and JSON payloads for APIs. It also covers HTTPS, CSRF attacks and tokens, and how Rails handles POST requests with create, params, Strong Parameters and form_with.
What you'll learn
- ✓Why POST requests change server state and are not idempotent
- ✓How the request body and the Content-Type header work
- ✓Responses with 201 Created, the Location header and Post/Redirect/Get
- ✓Sending HTML forms, multipart file uploads and JSON payloads
- ✓Protecting POST requests with HTTPS, CSRF tokens and SameSite cookies
- ✓Handling POST in Rails with create, params, Strong Parameters and form_with
What is the POST method?
While the GET method is for reading data, the POST method is for sending new data to the server.
Read the full lesson free →Curriculum
7 lessonsWhat is the POST method?
POST sends new data to the server, changes its state, and repeating it creates duplicate records.
Anatomy of a POST request
A POST request carries data in its body, and the Content-Type header tells the server its format.
The response of a POST request
Servers answer POST with 201 Created and a Location header, or redirect using the Post/Redirect/Get pattern.
Submitting web forms
HTML forms send POST data as URL-encoded strings by default, and file uploads need multipart/form-data.
JSON payloads and APIs
JavaScript clients send JSON payloads with fetch, and they must set Content-Type to application/json.
Security and POST requests
POST bodies travel as plain text without HTTPS, and CSRF tokens plus SameSite cookies block forged requests.
POST requests in Rails
Rails routes POST to the create action, parses data into params, and filters it with Strong Parameters.