Skip to content

Prevent retrying POST requests on network errors - #965

Draft
razor-x wants to merge 1 commit into
mainfrom
claude/javascript-http-post-replay-5se4n5
Draft

Prevent retrying POST requests on network errors#965
razor-x wants to merge 1 commit into
mainfrom
claude/javascript-http-post-replay-5se4n5

Conversation

@razor-x

@razor-x razor-x commented Aug 14, 2026

Copy link
Copy Markdown
Member

Summary

This change restricts automatic retry behavior to only idempotent HTTP methods (GET, HEAD, OPTIONS, PUT, DELETE), preventing POST requests from being retried when network-level errors occur. This is a critical safety improvement to avoid duplicate side effects (e.g., unlocking a door twice) when the client cannot confirm whether the server received and processed a request before the connection was lost.

Key Changes

  • Updated retry condition in src/lib/client.ts: Changed from axios-retry's default isNetworkOrIdempotentRequestError to isIdempotentRequestError, which only retries idempotent HTTP methods. This prevents POST requests from being automatically resent on network errors like connection resets or timeouts.
  • Added comprehensive test coverage in test/seam/connect/retry.test.ts:
    • Test verifying that POST requests are not retried on 503 status errors
    • Test simulating a mid-flight connection reset to ensure POST requests are not replayed when the server drops the connection after receiving the request
  • Updated documentation in README.md: Clarified the default retry behavior, explaining why POST requests are excluded and how users can customize this behavior if needed.

Implementation Details

The change leverages the isIdempotentRequestError function from the axios-retry library, which safely restricts retries to HTTP methods that are safe to send multiple times. This prevents the dangerous scenario where a non-idempotent request (like a POST to unlock a door) could be automatically resent after a network failure, potentially causing the operation to execute twice on the server side.

https://claude.ai/code/session_012fyJ8jtTb5MKU12Egz1jAq

axios-retry's default retryCondition, isNetworkOrIdempotentRequestError,
retries any network-level failure (timeout, connection reset) regardless
of HTTP method. Since the SDK's write endpoints are POST requests, a
connection reset or timeout mid-flight caused the same POST to be resent
up to 3 times even though the server may have already received and acted
on it, e.g., replaying an unlockDoor call.

Restrict the default retryCondition to axios-retry's isIdempotentRequestError
so only GET/HEAD/OPTIONS/PUT/DELETE are retried, matching the retry
semantics already documented for the Ruby and Python SDKs. Callers can still
opt back in per-request via axiosRetryOptions.

Also corrects the README, which described timeout retries without noting
they were previously replayed regardless of method.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants