<div class="gmail_quote">On Thu, Jan 22, 2009 at 5:35 PM, Trevor Phillips <span dir="ltr"><<a href="mailto:trevor.phillips@gmail.com">trevor.phillips@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Thu, Jan 22, 2009 at 3:12 PM, Toby Corkindale<br>
<<a href="mailto:toby.corkindale@strategicdata.com.au">toby.corkindale@strategicdata.com.au</a>> wrote:<br>
><br>
> But what happens when your site gets spidered by a search engine, that<br>
> follows all links?<br>
><br>
> Whoops.<br>
><br>
> There's a good reason state-modification-actions should be POST (or rather,<br>
> non-GET, if you want to go with PUT, DELETE, etc)<br>
<br>
</div>Surely such an action would be behind some form of authentication,<br>
ergo blocking any random web crawler? An app that allowed you to<br>
delete records with no security checks has bigger issues. ^_^</blockquote><div><br>Except, what if the crawler is inside the user's browser? Google's Web Accelerator supposedly caused a lot of grief in 2005 when it started pre-fetching non-idempotent GET requests for unsuspecting users..<br>
<br>Patrick Donelan<br><a href="http://patspam.com">http://patspam.com</a><br></div></div>