You know how HTTP GET requests are meant to be idempotent?

Re:You know how HTTP GET requests are meant to be idempotent? by dogma1138 on Tuesday May 01, 2018 @05:29AM (#16965601)

Well you don’t seem to validate the existing password prior to authorizing the change.

Good CSRF protection on GET requests is also near impossible to implement as GET is intended to be a “safe” request as in a request that does not modify a state but this isn’t something that is actually practiced.

[ Parent | on HN ]

Re:You know how HTTP GET requests are meant to be idempotent? by MrMid on Saturday May 05, 2018 @05:03AM (#17000999)

Actually, I do. This is not a form for user to change his own password, rather a administrators form to change another user's form. And for such actions the administrators identity and privileges are checked. But I understand your reasoning and thank you for pointing it out.

And yeah, I try to use GET only for safe requests, but I should be more careful.

[ Parent | on HN ]