4

Well, the title almost says everything. Magento uses a key parameter in the admin area which it appends to every URL. I was just wondering why they don't do this using php post instead of get.

With post it would be hidden, that's why I would prefer it, but I'm sure there is a good explanation for it.

Yorrd
  • 828
  • 1
  • 5
  • 19

2 Answers2

6

I don't have an official explanation, only the core team can tell you this.
But I can express my opinion.
Every page in the backend uses a key that is generated based on the url and a random string that is generated each time the session is refreshed.
This way all the pages have an additional security measure, not just the ones that are requested via POST.
It is impossible (or at least ugly) to make an application that relies only on POST requests.
For example the add/edit page of a product does not need a post request. A simple GET request is enough.

Marius
  • 197,939
  • 53
  • 422
  • 830
  • I was half way through replying with the same sentiment. Basically practicality. In order to make POST requests every single anchor link in the adminhtml section would need to be intercepted by JS. You'd need to store the key on the page in order to make it part of the POST data anyway, so there isn't really any increased security. So there's no real advantage in it IMO. – Peter O'Callaghan Mar 05 '15 at 11:52
  • fair enough, thanks for the explanation Marius and @Cags. I guess this makes sense even though I don't like the huge URLs resulting from this ;) – Yorrd Mar 05 '15 at 11:55
1

It isn't possible to choose GET or POST for a specific parameter. GET and POST are possible verbs for a complete http request.

There are lots of good reasons not to use POST requests all the time. By using a GET request we generally signal that the client doesn't have to care about any side effects of their request, which means it can easily be repeated, cached, bookmarked etc.

bdsl
  • 111
  • 1