Web Applications - Refactoring HTML: Improving the Design of Existing Web Applications - page 243

Chapter 7. Web Applications
In Web 2.0, many sites aren't just static pages anymore, or even static pages plus a few forms to fill out.
They're full-blown applications for data entry, word processing, calendar management, human resources,
games, and anything else you can imagine. In this chapter, we focus on issues that specifically arise in
improving such web applications.
Replace Unsafe GET with POST
Redesign unsafe operations so that they are accessed via POST rather than GET.
<a class="delete"
href="article.php?action=delete&amp;id=1000517&amp;nonce=76a62"
onclick="return deleteSomething('post', 1000517,
'You are about to delete this post &quot;POST vs.
GET&quot;.\n&quot;OK&quot; to delete,
&quot;Cancel&quot; to stop.'
);">Delete</a>
<form method="post" action="articles.php">
<input name="action" value="delete" type="hidden" />
<input name="id" value="1000517" type="hidden" />
<input name="nonce" value="76a62" type="hidden" />
<input type="submit" value="Delete" />
</form>
Motivation
URLs accessed via GET can be and are spidered, prefetched, cached, repeated, and otherwise accessed
automatically. Unsafe operations such as confirming a subscription, placing an order, agreeing to a contract,
and deleting a page should be performed only via POST to avoid accidentally taking such actions without explicit
user request and consent.
Potential Trade-offs
Browser users can only access POST functionality through HTML forms. They cannot simply follow a link. To be
honest, this is a feature, not a bug. However, it does tend to restrict the formatting you can apply to an
operation.
You may also discover that some firewalls and proxy servers are configured to allow GET requests through but
block POST requests. Thus, switching from GET to POST may prevent some people in high-security installations
from accessing your site. Again, this is a feature, not a bug. HTTP is designed to enable network administrators
to control their network traffic and separate safe requests from potentially unsafe ones. If the network
administrator has chosen to block POST, that is their decision and right, not yours. Do not attempt to subvert
other sites' security policies by tunneling POST through GET.
Mechanics
Consider each action on your site that is serviced by a script or program rather than a static file. In particular,