3 ms·
> And that's the problem. Which again, it's a known problem, existed for many years already and we have a work around for. If you want to do POST requests from
by diggan 2y ago
> And that's the problem.
Which again, it's a known problem, existed for many years already and we have a work around for. If you want to do POST requests from URLs sent via email/other communication platforms, you need to make it so the user confirms the activity.
Users who wanted to sign in and have to press a button after loading the page instead of just logging them in won't suddenly not want to login. They have a clear purpose when clicking the link, regardless if they have to click one button afterwards or not.
And besides, if you don't implement it like that, you'll have even more users dropping off because they literally won't be able to sign in at all, no matter how badly they want to.
- mschuster91 2y ago> Which again, it's a known problem, existed for many years already and we have a work around for. Not really. Other than Google's crawlers it was rare to see full browser engines or even JS runtimes as part of "security" solutions.
- diggan 2y agoBoth Microsoft and Google been doing this in emails for many years. I linked elsewhere a SO question from 7 years ago talking about this issue for gmail, others mentioned some Microsoft stuff there too.
- im3w1l 2y agoWon't this shift the meta for malware to a "button" that is 99.9% transparent and overlays the whole page in the hope that someone will accidentally click on it when trying to select text or something? A lot better than 0-click ig but might catch people now and then.