Hacker News Reader

Comment by twism | Hacker News Reader

unless the search indexer has registered, logged in, and posting stories and comments, its a non-issue

Yes, that's fine as long as your logged in users don't use some form of "web accelerator" that pre-fetches "delete" links.

Using get instead of post for these kind of actions is just asking for trouble.

Using some form of "web accelerator" is asking for trouble. I consider Paul's method better than requiring Javascript to vote or making the voting links some wacky kind of button element.

If HTML had a method="post" option on <a>'s then it would be no problem to always use the proper HTTP verb, but we have to satisfice with what we've got.

I, too, have often wished for the method attribute you describe.

That said, if you're already using javascript (as news.YC is), I really don't see why you wouldn't make use of xhr. In which case you could submit the request as a post.

Note: I haven't poked around enough to see if news.YC works without javascript. If they degrade gracefully, more power to them, and I can almost understand the decision to do it the way they have.

I take the BOFH outlook on this: that problem is isomorphic to the problem of a user leaking his account credentials to a malicious third party and should be dealt with in the same manner.

thats true. [adding to the TODOs for my web app. :sigh:]

You can just add rel="nofollow" to those links, by the way.

Edit: Or so I thought. I'm wrong.

It turns out there's no standard for this, so who knows what you can do today. But practically, Google Web Accelerator doesn't prefetch links with a query string, at least currently. So Paul's voting links are A-OK with GWA. And that's the only one that you need to worry about, at least today.

do all web accelerators obey that?

Thanks for asking, I double-checked and there are of course not even any informal standards for web accelerators, apart from their common appeal to the HTTP 1.1 standard when the issue of link following safety comes up:

http://webaccelerator.google.com/webmasterhelp.html#prefetch...

I've edited my post. Thanks for your reply.

All the good ones follow specifications and good practices religiously. But I've never met a good one.

Reply on news.ycombinator.com