Hacker News Reader

Wait, from reading the article it looks like the link they send to their users send them to a page with some javascript which automatically POST data for them. Which MS will correctly do: your "POST" is in fact a simple GET for most users with javascript on.

What you should do is send your user to a page with a form requiring a manual action from them.

View on HN

This just highlights how the security scanning is just theater though. So bad actors can now just have their evil content behind a form, and users get accustomed to the double opt-in workflow anyway.

Yup, best thing would be to either have a form in your email / SMS or let's get crazy: implement POST links (and maybe DELETE ones too). Your client knows it will change things when followed (so security clients and prefetchers won't open it), the server receive a POST request, and it's a one click action for the user.

Reply on news.ycombinator.com