4 ms·
Yes, that's fine as long as your logged in users don't use some form of "web accelerator" that pre-fetches "delete" links. Using get instead of post for these
by Locke 19y ago
Yes, that's fine as long as your logged in users don't use some form of "web accelerator" that pre-fetches "delete" links.
Using get instead of post for these kind of actions is just asking for trouble.
- dfranke 19y agoI take the BOFH outlook on this: that problem is isomorphic to the problem of a user leaking his account credentials to a malicious third party and should be dealt with in the same manner.
- twism 19y agothats true. [adding to the TODOs for my web app. :sigh:]
- zach 19y agoYou can just add rel="nofollow" to those links, by the way. Edit: Or so I thought. I'm wrong. It turns out there's no standard for this, so who knows what you can do today. But practically, Google Web Accelerator doesn't prefetch links with a query string, at least currently. So Paul's voting links are A-OK with GWA. And that's the only one that you need to worry about, at least today.
- twism 19y agodo all web accelerators obey that?
- SwellJoe 19y agoAll the good ones follow specifications and good practices religiously. But I've never met a good one.
- deleted 19y ago[deleted]
- zach 19y agoThanks for asking, I double-checked and there are of course not even any informal standards for web accelerators, apart from their common appeal to the HTTP 1.1 standard when the issue of link following safety comes up: http://webaccelerator.google.com/webmasterhelp.html#prefetch3 http://webaccelerator.google.com/webmasterhelp.html#prefetch... I've edited my post. Thanks for your reply.
- zach 19y agoUsing some form of "web accelerator" is asking for trouble. I consider Paul's method better than requiring Javascript to vote or making the voting links some wacky kind of button element. If HTML had a method="post" option on <a>'s then it would be no problem to always use the proper HTTP verb, but we have to satisfice with what we've got.
- Locke 19y agoI, too, have often wished for the method attribute you describe. That said, if you're already using javascript (as news.YC is), I really don't see why you wouldn't make use of xhr. In which case you could submit the request as a post. Note: I haven't poked around enough to see if news.YC works without javascript. If they degrade gracefully, more power to them, and I can almost understand the decision to do it the way they have.