4 ms·
HTTP GET requests should not be interpreted by the server as a request to change something. That's what POST, PUT, DELETE and PATCH are for.
by wcoenen 5y ago
HTTP GET requests should not be interpreted by the server as a request to change something. That's what POST, PUT, DELETE and PATCH are for.
- justinator 5y agoI agree, but how do you initiate a POST request via an email message? Embedding a form sometimes raises its own security alert.
- dragonwriter 5y ago> I agree, but how do you initiate a POST request via an email message? Embedding a form sometimes raises its own security alert. So, your question is how to evade security alerts for actions with potentially significant side effects?
- justinator 5y ago> So, your question is how to evade security alerts for actions with potentially significant side effects? Well there's already a big ol' button in an email that says, "click me to register". The end user doesn't really care about the implementation. If one pops up a security alert (the POST form) and one doesn't (the simple link), how do you think everyone implements that big ol' button, 100% of the time, for 100% of everything? I wish email didn't work this way, but as far as I understand, this is the lay of the land. If there's a better way, I'll be happy to implement it in the system(s) that I have control over. I'm really asking for engagement within the community with help solving this sticky problem (if it wasn't clear). If link caching is this prevalent, what to do about it, for things like registering via email?
- SilverRed 5y agoYou can do it with js but that assumes that google is not running any js which is probably not a safe assumption.
- wcoenen 5y agoThe unsubscribe link should lead to a separate HTML form describing the unsubscription and a "confirm" button.