Using POST where PUT was appropriate is a common real-world bug source because POST is not idempotent, so retried or duplicated requests, such as from a flaky network or a double-click, can create duplicate records instead of safely repeating the same update.
Key Points: • PUT is idempotent by design, meaning identical repeated requests produce the same end state rather than additional side effects. • POST is meant for creating a new resource each time it's called, so using it for updates risks duplicate creation on retries. • Client retries, browser back-button resubmissions, and network timeouts followed by automatic retries are common triggers for this bug. • A pragmatic fix is switching update operations to PUT (or PATCH for partial updates) so retries are safe. • As a defensive measure, checking for an existing matching record before creation, or using idempotency keys, prevents duplicates even when POST must be used.
Example: A checkout form using POST for order submission created duplicate orders when a user's network hiccuped and their browser silently retried the request; switching to an idempotent PUT with a client-generated order ID fixed the duplication.
Interview Tip: A concise interview answer is:
"I've seen POST used for update operations cause duplicate records when a request got retried due to a flaky connection, since POST isn't idempotent. The fix was switching to PUT with a stable resource identifier so retries just repeat the same update safely, and adding idempotency checks for cases where POST for creation was still necessary."