4 ms·

What's your problem with it?

• Pooge 1y ago
  That any bot crawling your website is going to click on your links and inadvertently mutate data. Reading your original comment I was thinking "Sure, as long as you have a good reason of doing it this way anything goes" but I realized that you prefer to do it this way because you don't know any better.
  • TekMol 1y ago
    If you rely on the HTTP method to authenticate users to mutate data, you are completely lost. Bots and humans can send any method they like. It's just a string in the request. Use cookies and auth params like HN does for the upvote link. Not HTTP methods.
    • Pooge 1y ago
      > If you rely on the HTTP method to authenticate users to mutate data, you are completely lost I don't know where you are getting that from but it's the first time I've heard of it. If your link is indexed by a bot, then that bot will "click" on your links using the HTTP GET method—that is a convention and, yes, a malicious bot would try to send POST and DELETE requests. For the latter, this is why you authenticate users but this is unrelated to the HTTP verb. > Use cookies and auth params like HN does for the upvote link If it uses GET, this is not standard and I would strongly advise against it except if it's your pet project and you're the only maintainer. Follow conventions and make everyone's lives easier, ffs.
    • imtringued 1y ago
      You say that, but there are lots of security features like SameSite=Lax that are built on the assumption that GET requests are harmless.
  • deleted 1y ago
    [deleted]
• Scarblac 1y ago
  Bots, browsers that preload URLs, caching (both browser and backend and everything in between), the whole infrastructure of the Web that assumes GET never mutates and is always safe to repeat or serve from cache. Using GET also circumvents browser security stuff like CORS, because again the browser assumes GET never mutates.
  • TekMol 1y ago
    So why is there no problem with vote/flag/vouche on HN being GET endpoints?
    • buzzy_hacker 1y ago
      https://news.ycombinator.com/item?id=3742902 https://news.ycombinator.com/item?id=3742902
      • bmacho 1y ago
        Indeed, user embedded pictures can fire GET requests while can not make POST requests. But this is not a problem if you don't allow users to embed pictures, or you authenticate the GET request somehow. Anyway GET requests are just fine.
      • TekMol 1y ago
        The same would have worked with a POST endpoint. The story url only would have to point to a web page that creates the upvote post request via JS.
        • Scarblac 1y ago
          That runs into CORS protections though. CORS is a lot less strict around GET as it is supposed to be safe.
          • TekMol 1y ago
            Nope, it would not have been prevented by CORS. CORS prevents reading from a resource, not from sending the request. If you find that surprising, think about that the JS could also have for example created a form with the vote page as the target and clicked on the submit button. All completely unrelated to CORS.
• boruto 1y ago
  There was a post about Garage opener I read here sometime back. https://news.ycombinator.com/item?id=16964907 https://news.ycombinator.com/item?id=16964907