<div dir="ltr"><br>
<br><br><div class="gmail_quote">On Wed, Sep 24, 2008 at 10:09 PM, Steven Wittens <span dir="ltr"><<a href="mailto:steven@acko.net">steven@acko.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Also, you shouldn't be taking any action just from a GET request, or you're opening yourself to CSRF (Cross site request forgery). To avoid this, you need a confirm form that uses POST to actually trigger the action.<br>
</blockquote>
<br>
<br></div>
This isn't really about GET vs POST, but rather about using session-derived tokens (which you get for free with Form API). To avoid the annoyance of a confirm form, you can add and verify tokens manually with drupal_get_token() and drupal_valid_token(). Which you should be doing for ajax callbacks anyway, regardless of whether they are POST or GET.<br>
<font color="#888888">
<br>
Steven</font></blockquote><div><br>This is why you should use sessionsbased tokens, <a href="http://www.codinghorror.com/blog/archives/001171.html">http://www.codinghorror.com/blog/archives/001171.html</a><br></div></div>
<br clear="all">Regards,<br> Johan Forngren :: <a href="http://johan.forngren.com/">http://johan.forngren.com/</a><br></div>