# REST and create action: why does it accept GET requests?

**URL:** <https://www.ruby-forum.com/t/rest-and-create-action-why-does-it-accept-get-requests/138112>\
**Category:** Rails\
**Created:** [May 20, 2008, 10:08am UTC](https://www.ruby-forum.com/t/rest-and-create-action-why-does-it-accept-get-requests/138112 "2008-05-20T10:08:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\
**Post date:** [May 20, 2008, 10:08am UTC](https://www.ruby-forum.com/t/rest-and-create-action-why-does-it-accept-get-requests/138112/1 "2008-05-20T10:08:11Z")

</div>

Hi \*,

# TODO: why does this method accept get requests ?

# it “should not login getting correct credentials” do

# get :create, :login =\> ‘quentin’, :password =\> ‘test’

# session[:user\_id].should be\_nil

# flash[:notice].should be\_nil

# end

This spec fails, but AFAIK create actions that are routed  
as .resources should accept just POSTed data, not GETted. Here the  
session is setted to the user.id, and the Flash notice says I logged  
in successfully, this doesn’t really make sense to me. Rails 2.0.2

TIA,  
ngw

---

<div class="post-metadata">

**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\
**Post date:** [May 20, 2008, 10:47am UTC](https://www.ruby-forum.com/t/rest-and-create-action-why-does-it-accept-get-requests/138112/2 "2008-05-20T10:47:18Z")

</div>

Nicholas W. wrote:

> Hi \*,
> 
> # TODO: why does this method accept get requests ?
> 
> # it “should not login getting correct credentials” do
> 
> # get :create, :login =\> ‘quentin’, :password =\> ‘test’
> 
> # session[:user\_id].should be\_nil
> 
> # flash[:notice].should be\_nil
> 
> # end

I think the way that it works is Rails will route POST requests to the  
/users/ url to create. However, if you explicitly call the create method  
using a GET (as you are doing here), I don’t think Rails will stop you.

I think if you want to check that the routing is working it is possible  
using Rspec.

Disclaimer: The exuberant use of “think” in the answer means that I am  
also still learning 😉

---

<div class="post-metadata">

**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\
**Post date:** [May 20, 2008, 12:17pm UTC](https://www.ruby-forum.com/t/rest-and-create-action-why-does-it-accept-get-requests/138112/3 "2008-05-20T12:17:03Z")

</div>

That is what verify is for:

[http://rails.rubyonrails.org/classes/ActionController/Verification/ClassMethods.html](http://rails.rubyonrails.org/classes/ActionController/Verification/ClassMethods.html)

verify :method =\> :post, :redirect\_to =\> etc…

---

<div class="post-metadata">

**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\
**Post date:** [May 20, 2008, 12:59pm UTC](https://www.ruby-forum.com/t/rest-and-create-action-why-does-it-accept-get-requests/138112/4 "2008-05-20T12:59:01Z")

</div>

On 20 May 2008, at 09:06, Nicholas W. wrote:

> as .resources should accept just POSTed data, not GETted. Here the  
> session is setted to the user.id, and the Flash notice says I logged  
> in successfully, this doesn’t really make sense to me. Rails 2.0.2

Routing isn’t used in a functional test - rails just whacks the  
specified action at the controller being tested

Fred