3 ms·
>Web applications make state-changing operations on GET requests. You might not like it, but they do. but when developer made a mistake with GET it is 100% his
by homakov 15y ago
>Web applications make state-changing operations on GET requests. You might not like it, but they do.
but when developer made a mistake with GET it is 100% his problem - it's out of question. he should be punished :D
- tptacek 15y agoNonsensical. CSRF isn't God's punishment for REST-lessness.
- baddox 15y agoYou're both just choosing different places to draw the line between developer responsibility and browser responsibility.
- tptacek 15y agoThat is like saying "you're both just suggesting two totally different designs for the HTTP security model". His model is wrong. Again: I assume he wants to know that, so, bluntness.