Exercise 2: Why This Action Must Never Be a Plain GET — Possible Solution ==================================================================== WHY GET IS THE WRONG CHOICE FOR A STATE-CHANGING ACTION ------------------------------ A GET request is meant to be safe - something that can happen without the user's deliberate intent, since browsers and other tools routinely make GET requests on their own as part of normal page behavior. Using GET for an action that actually changes data violates that expectation, because now something meant to be harmless can silently alter real state. A CONCRETE EXAMPLE OF ACCIDENTAL TRIGGERING ------------------------------ If "Mark Used" were implemented as a plain link (e.g. an ) instead of a button firing a PATCH request, a browser's own link-prefetching feature could load that URL in the background purely to speed up navigation - before the user ever clicked anything at all. Similarly, an automated crawler or link-checking tool following every link on a page would trigger the same GET request, silently marking the item used with no human action behind it whatsoever. WHY THIS WORKS AS AN ANSWER ------------------------------ It correctly explains why GET's own "safe by convention" expectation is violated by a state-changing action, and gives a concrete, specific mechanism (browser link-prefetching or an automated crawler) that could trigger a GET-based version without the user's actual intent.