Using GET instead of POST to delete data behind authenticated pages

Question

I know that you should use POST when the data is changed on a public website. There are several reasons, including the fact that search engines will follow all links and modify data.

My question is: do you think that using GET behind authenticated pages in some kind of interface?

One example is a list of products with a link to delete on each line. Since the only way to get to the page is if you are logged in, is there any harm only when using the link with the product identifier in the query line?

Comment development:

I personally do not have problems or problems when performing deletions using POST. I just saw some code examples in ASP.NET and ASP.NET MVC for pages like "admin like" that use GET instead of POST. I am curious about the opinions of people on this issue.

Answer 1

Some people have learned that this is a very bad idea.

Google " " (Google Web Accelerator), ( , ...), - , : ", , , "

, - .

Answer 2

GET , JavaScript. , , , GET .

, , , GET , POST, . :

<a href="/controller/delete/1" onclick="$.post(this.href); return false;">Delete</a>

GET /controller/delete/x, POST. POST (, , DELETE), .

Answer 3

- GET - - (?) -, URL, (, XSS). , , , RESTful.

, ...

Answer 4

GET POST . . , , " " .

XSS CSRF, HTML () , , / captchas.

Answer 5

.

() GET, . , , ( prefetching ).

Answer 6

GET. , -. , GET- . URL- - . - http://www.fakesite.site/posts/delete?ID=1, , , ID # 1, .

Answer 7

, , - , - , . : " , ?"

Answer 8

GET POST , , , GET HTTP, URL.

, , , get .