asp.net - 为什么我们在 asp.net MVC 中执行 POST 来确认删除？

Question

以下是来自 Scott Hanselman++ 的专业 ASP.NET MVC 2 的注释

You might ask — why did we go through the effort of creating a <form> within our Delete Confi rmation screen? Why not just use a standard hyperlink to link to an action method that does the actual delete operation? The reason is because we want to be careful to guard against Web-crawlers and search engines discovering our URLs and inadvertently causing data to be deleted when they follow the links. HTTP-GET-based URLs are considered safe for them to access/crawl, and they are supposed to not follow HTTP-POST ones. A good rule is to make sure that you always put destructive or data-modifying operations behind HTTP-POST requests.

如果网络爬虫和搜索引擎无法访问包含删除按钮的页面，那么使用标准超链接链接到执行实际删除操作的操作方法是否安全？

Answer 1

一个好的经验法则是 GET 不应更改数据。如果您想更改某些数据，请使用 POST。

这就是为什么 ScottHa 等使用表单来提交删除。如果它不适用于您的应用，您可以根据需要使用 GET。

或者，您可以使用 JavaScript 在用户单击链接时提交表单。