You know how HTTP GET requests are meant to be idempotent?

Re:You know how HTTP GET requests are meant to be idempotent? by MrMid on Tuesday May 01, 2018 @04:55AM (#16965475)

Well, a while ago I saw this code (on my own project!): window.open("?controller=users&action=changePassword&name=" + user_name + "&password=" + password)

I was horrified, glad it isn't live yet, and I fixed it immediately. But I'm still wondering whether I was so sleep-deprived or drunk when I wrote this. It's over SSL, so it should not be that big deal, but still, GET shouldn't be used for such things.

[ Parent | on HN ]

Re:You know how HTTP GET requests are meant to be idempotent? by dogma1138 on Tuesday May 01, 2018 @05:29AM (#16965601)

Well you don’t seem to validate the existing password prior to authorizing the change.

Good CSRF protection on GET requests is also near impossible to implement as GET is intended to be a “safe” request as in a request that does not modify a state but this isn’t something that is actually practiced.

[ Parent | on HN ]

Re:You know how HTTP GET requests are meant to be idempotent? by MrMid on Saturday May 05, 2018 @05:03AM (#17000999)

Actually, I do. This is not a form for user to change his own password, rather a administrators form to change another user's form. And for such actions the administrators identity and privileges are checked. But I understand your reasoning and thank you for pointing it out.

And yeah, I try to use GET only for safe requests, but I should be more careful.

[ Parent | on HN ]

Re:You know how HTTP GET requests are meant to be idempotent? by jimktrains2 on Tuesday May 01, 2018 @08:48AM (#16966542)

Another big deal is that it'll get stored in server logs too.

[ Parent | on HN ]

Re:You know how HTTP GET requests are meant to be idempotent? by dharmab on Wednesday May 02, 2018 @01:36AM (#16974339)

It's a big deal since it will be visible in access logs in plaintext, so if the logs are compromised your users would be too.

[ Parent | on HN ]