4

Well, the title almost says everything. Magento uses a key parameter in the admin area which it appends to every URL. I was just wondering why they don't do this using php post instead of get.

With post it would be hidden, that's why I would prefer it, but I'm sure there is a good explanation for it.

Improve this question

2 Answers 2

Reset to default
6

I don't have an official explanation, only the core team can tell you this.
But I can express my opinion.
Every page in the backend uses a key that is generated based on the url and a random string that is generated each time the session is refreshed.
This way all the pages have an additional security measure, not just the ones that are requested via POST.
It is impossible (or at least ugly) to make an application that relies only on POST requests.
For example the add/edit page of a product does not need a post request. A simple GET request is enough.

Improve this answer
2
  • I was half way through replying with the same sentiment. Basically practicality. In order to make POST requests every single anchor link in the adminhtml section would need to be intercepted by JS. You'd need to store the key on the page in order to make it part of the POST data anyway, so there isn't really any increased security. So there's no real advantage in it IMO.
    – Peter O'Callaghan
    Mar 5, 2015 at 11:52
  • fair enough, thanks for the explanation Marius and @Cags. I guess this makes sense even though I don't like the huge URLs resulting from this ;)
    – Yorrd
    Mar 5, 2015 at 11:55
1

It isn't possible to choose GET or POST for a specific parameter. GET and POST are possible verbs for a complete http request.

There are lots of good reasons not to use POST requests all the time. By using a GET request we generally signal that the client doesn't have to care about any side effects of their request, which means it can easily be repeated, cached, bookmarked etc.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.