> It wasn’t a problem everywhere. It was only a problem > where people used GET in an unsafe way, this is technically correct. > which was a minority

> It wasn’t a problem everywhere. It was only a problem > where people used GET in an unsafe way, this is technically correct. > which was a minority of sites. I don't think those were minority. Minority of sited got hit by GWA, but before thad not many cared about what method was used either. PHP rulled the web back then, and I doubt security practices were much better. Heck, even Google's own Blogger was hit by it, iirc. That makes Rails prominent was that 37Signals were very prominent at the time, so everything Jason F. or DHH said was heard wide. And while you are right about following the spec being the proper way, implementing a quick fix to block GWA may be quickier to deploy than rewriting the app to use proper methods. These admin interfaces should have been under HTTPS anyway, and GWA did not follow HTTPS links. All those mistakes no web apps side do not mean that GWA was a good idea anyway, because it caused other problems which had nothing or little to do with idempotency: infalted traffic stats, messed up caches, etc.