Change like reshare and follow so they are forms #88

Closed
opened 2018-06-26 16:58:57 +00:00 by trinity-1686a · 2 comments

Currently like, reshare and follow are made through GET requests, however for security reason they should be done through POST request, such as via forms. Can someone try to change those links to forms without breaking current design?
b26649e8c0/templates/posts/details.html.tera (L43-L56)
b26649e8c0/templates/users/header.html.tera (L22-L26)

Currently `like`, `reshare` and `follow` are made through GET requests, however for security reason they should be done through POST request, such as via forms. Can someone try to change those links to forms without breaking current design? https://github.com/Plume-org/Plume/blob/b26649e8c0d92b5bbf57d69ef5176e1f1667202a/templates/posts/details.html.tera#L43-L56 https://github.com/Plume-org/Plume/blob/b26649e8c0d92b5bbf57d69ef5176e1f1667202a/templates/users/header.html.tera#L22-L26
Madeorsk commented 2018-06-27 15:41:44 +00:00 (Migrated from github.com)

Why use POST instead of GET? CSRF?

Why use POST instead of GET? CSRF?
elegaanz commented 2018-06-27 16:01:45 +00:00 (Migrated from github.com)

This is the main reason yes, and because it is more correct semantically too.

This is the main reason yes, and because it is more correct semantically too.
Sign in to join this conversation.
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Plume/Plume#88
No description provided.