4 ms·
I recall reading a story about someone who had implemented some sort of table using links for actions. At some point the app data mysteriously got wiped out. Tu
by lhorie 8y ago
I recall reading a story about someone who had implemented some sort of table using links for actions. At some point the app data mysteriously got wiped out. Turned out a user had Alexa toolbar installed and it crawled the "delete" links on each row (as well as all the pagination links)...
- nicoburns 8y agoThis is easily solves by using an invisible form with hidden elements...
- billysielu 8y ago2 wrongs don't make a right
- CGamesPlay 8y agoThe web server had a deficiency where it modified data on HTTP GET requests. We could probably agree that navigation should be links and other actions should be buttons. Visual appearance of such should probably be left alone, but is technically a decision that can be made independently.
- JimDabell 8y agoThis happened repeatedly with 37signals/Rails and Google Web Accelerator: http://blog.moertel.com/posts/2005-10-25-google-web-accelerator-vs-unsafe-linking-round-two.html http://blog.moertel.com/posts/2005-10-25-google-web-accelera...
- astura 8y agoThis is what happens when you use a HTTP GET to perform an "unsafe" action. HTTP GET links should always be safe to crawl... Always... It's in the spec for a reason. Seen people make mistakes like this before... Even using a POST when it should be a GET can cause funny behavior. Funny, but not dangerous behavior like using GET instead of POST. Whenever I bring a new web dev aboard this is my first lesson to them, and I say "all sorts of clients are going to crawl your webapp, so make sure your webapp is coded correctly for it." Browsers are coded with this assumption, bots/crawlers, email clients, etc...
- 3pt14159 8y agoTruth. Also, junior devs don't use HTTP error codes and it always ends up biting them at some point. A 200 response with a body that says "server error" isn't going to bubble up through your JS properly.
- adrianratnapala 8y ago> This is what happens when you use a HTTP GET to perform an "unsafe" action Yes, I agree it sucks. But there are also no great alternatives without JS.
- dragonwriter 8y agoUsing buttons that trigger POST methods is a great alternative to using links for non-safe actions, and doesn't require JS.