Question

How should a random number generator properly be implemented in REST?

GET   RANDOM/

or..

POST  RANDOM/

The server returns a different random number each time.

I can see arguments for both ways.

Answer 1

I’d say this is the same as for a page returned that contains the current time – and many of these are done using GET. Abstractly, fetching a random number (or time) the server’s state doesn’t change – both time and random numbers can be described as an observation of an external event. E.g. http://random.org use atmospheric noise.

GET seems most appropriate, although caching will need to be disabled via appropriate headers, e.g.

Expires: <Current Time>
Last-Modified: <Current Time>
Cache-Control: no-cache, must-revalidate
Pragma: no-cache

If you want to ensure that the served content is already expired:

To mark a response as “already
expired,” an origin server sends an
Expires date that is equal to the Date
header value. (See the rules for
expiration calculations in section
13.2.4.)

• http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html