4 ms·
That any bot crawling your website is going to click on your links and inadvertently mutate data. Reading your original comment I was thinking "Sure, as long a
by Pooge 1y ago
That any bot crawling your website is going to click on your links and inadvertently mutate data.
Reading your original comment I was thinking "Sure, as long as you have a good reason of doing it this way anything goes" but I realized that you prefer to do it this way because you don't know any better.
- TekMol 1y agoIf you rely on the HTTP method to authenticate users to mutate data, you are completely lost. Bots and humans can send any method they like. It's just a string in the request. Use cookies and auth params like HN does for the upvote link. Not HTTP methods.
- Pooge 1y ago> If you rely on the HTTP method to authenticate users to mutate data, you are completely lost I don't know where you are getting that from but it's the first time I've heard of it. If your link is indexed by a bot, then that bot will "click" on your links using the HTTP GET method—that is a convention and, yes, a malicious bot would try to send POST and DELETE requests. For the latter, this is why you authenticate users but this is unrelated to the HTTP verb. > Use cookies and auth params like HN does for the upvote link If it uses GET, this is not standard and I would strongly advise against it except if it's your pet project and you're the only maintainer. Follow conventions and make everyone's lives easier, ffs.
- imtringued 1y agoYou say that, but there are lots of security features like SameSite=Lax that are built on the assumption that GET requests are harmless.
- deleted 1y ago[deleted]