3 ms·

I know why the button is there, as GET requests are not supposed to change state but POST requests can, and you can only make a GET request by clicking on a lin

by billpg 5y ago

I know why the button is there, as GET requests are not supposed to change state but POST requests can, and you can only make a GET request by clicking on a link in the email. I'd be interested to see if that interpretation has been upheld by a court. Has anyone taken legal action arguing that the server should have used the GET request as the action to unsubscribe, not made the user click an extra button to get that POST request.

HideousKojima 5y ago
You can change state with a GET request. You aren't "supposed" to do it but there's no technical barrier preventing an unscrupulous company from effectively using the GET as a POST.
- deleted 5y ago
  [deleted]
- jcuenod 5y ago
  Wait, what do scruples have to do with how you handle GET and POST?
  - billpg 5y ago
    Remember those web counter images that would increment the number displayed each time it received a GET request? They were the most evil. -scary laughter-
    - number6 5y ago
      Thankfully they were all replaced by Google - Do no Evil - Analytics
ranguna 5y ago
> you can only make a GET request by clicking on a link in the email. Took a look and indeed there are a lot of email clients that don't support the form tag. https://www.caniemail.com/features/html-form/ https://www.caniemail.com/features/html-form/