[Catalyst] Re: how to confirm before deleteing

[Carl Johnstone]

Aristotle Pagaltzis wrote:
>     <img src="http://yourapp.example.org/addressbook/delete/all">
>
> into a page they control and then send a link to that page to
> your users. If you allow destructive actions on GET, you have
> just allowed for your users to be screwed over through no fault
> of their own.

Note that using POST rather than GET doesn't protect you from this specific 
problem - it's still possible to form a CSRF request with a POST action.

Carl