Re: Global Namespaces

[Chris Travers <..hidden..>]

On Sat, Mar 13, 2010 at 12:12 PM, Luke <..hidden..> wrote:
> Wouldn't it be somewhat more secure, not to use get at all?
> Or, at least, very minimally?
>
> We won't be sending passwords that way any more, but still...
>

Well, it doesn't entirely prevent XSRF attacks, so the benefit would
be very minimal.

Furthermore, if we agree that data shouldn't be saved to the db on a
GET request, then the XSRF benefits are the same.

I guess there is a question why
reports/trial_balance.html?from=2009-01-01&to=2009-12-31&ignore_yearend=none
would be any less secure than requiring a post.

Best Wishes,
Chris Travers