4 ms·

this isn't poorly designed, there are the web specs and then there's the web itself and if it works then the spec need updating, there's no law that post should

by hnriot 13y ago

this isn't poorly designed, there are the web specs and then there's the web itself and if it works then the spec need updating, there's no law that post should be used for session state, that was just someone writing it into an RFC, the fact that GET works just fine and a significant population of web apps use GET that way makes it reality more than any spec does.

windsurfer 13y ago
Read a bit more about how this is a problem at http://abielinski.com/logout http://abielinski.com/logout
- codygman 13y ago
  You got me :) This is the very essence of the problem.
- ben0x539 13y ago
  Sweet, RequestPolicy protected me. ;)
codygman 13y ago
Just because using GET to do destructive things "works" doesn't mean the spec should be changed to allow it. By your logic, we should just get rid of all requests except GET. Someone sends you a link, you click it, it loads in your web browser telling you that you've sent them $5000. That is why POST, PUT, OPTIONS, and all the other methods exist. This is most certainly poorly designed. Just because most web apps and web app developers suck doesn't mean that the freaking HTTP Standard should be changed. Just no... please stop.