you just rewrote my post in other words. Of course I know how to send POST and I call this a little bit "new" vector only because even good developers(check sho

you just rewrote my post in other words. Of course I know how to send POST and I call this a little bit "new" vector only because even good developers(check showcases to make sure) use 'match' and forget to specify :via. And it looks OK to them because they miss the point - all GET requests skip protect_from_forgery filter in Rails - this is how it works. >If you're a web dev making these mistakes then you need to take the time to learn about basic web security. Honestly, I didn't say it loudly but I meant it. Not understanding GET/POST makes person low skilled dev.