3 ms·
If a page contains JavaScript that makes a POST request when the page loads, then it’s the developers of that page that are violating HTTP norms, not the develo
by JimDabell 2y ago
If a page contains JavaScript that makes a POST request when the page loads, then it’s the developers of that page that are violating HTTP norms, not the developers of software that loads such pages. POSTs are unsafe requests that should be made as part of a user’s intent. Following a link should always be safe. Microsoft aren’t responsible for this problem – the site developers are.
We already went through this with Google Web Accelerator and 37Signals twice. They couldn’t accept that mere links were a bad idea for deleting things, and GWA came along and deleted their users’ data by following links. They tried to detect and block GWA instead of following HTTP rules and it happened again.
Links are supposed to be safe. Ignore this at your peril.
- Avamander 2y agoMicrosoft making this change also rather clearly indicates that malicious actors are actively abusing these spec violations (by walling their phishing pages behind a simple POST on page load).
- superq 2y agoClicking a link signals the user's intent. That's how hypertext works. Click here to agree.
- JimDabell 2y agoClicking a link indicates the user wants to see something. Clicking a button indicates the user wants to do something. Links shouldn’t change state. This has been an extremely strong convention for several decades. If you write code that changes state when a page is loaded, you are breaking this convention.