PHP Security: send POST to same URL = bad?

Question

I had a response on a question yesterday about sending POST data to the same page with the Post-Redirect-Get pattern like this:

if (isset($_POST['Submit'])) {
    // prevent resending data
    header("Location: " . $_SERVER['PHP_SELF']);
}

Someone replied: sending data to same PHP page from Javascript, no AJAX or forms

It is extremely important for the purposes of web security that a POST cannot be sent via a simple URL.

Now I would like to know what is wrong with this? I want to avoid using a separate page with the confirmation message, because it just breaks the user experience and from a design POV it is a no-go.

I'm not sure I understand what the person means when they say it's important for POST not be be sent via a "simple" URL. — Nev Stokes
– Nev Stokes, Commented Oct 26, 2010 at 9:17
here is the link: stackoverflow.com/questions/4016968/… Person has 26K reputation. — TunaFFish
– TunaFFish, Commented Oct 26, 2010 at 9:26
Reputation on SO doesn't mean all that much... (25K as of this writing) ;) — deceze
– deceze ♦, Commented Oct 26, 2010 at 9:31

Johannes Gorset · Accepted Answer · 2010-10-26 09:28:03Z

6

It is extremely important for the purposes of web security that a POST cannot be sent via a simple URL.

I think the person who said this might have misunderstood either you or web security.

There's nothing wrong with using the same URL for different request methods (GET, POST, PUT, DELETE, HEAD etc). In fact, it's a very good idea.

edited Oct 26, 2010 at 9:28

answered Oct 26, 2010 at 9:17

Johannes Gorset

8,7834 gold badges39 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Gumbo · Accepted Answer · 2010-10-26 09:35:16Z

1

It is extremely important for the purposes of web security that a POST cannot be sent via a simple URL.

I rather interpret this sentence that it should not be possible that a GET request on the same URL does not cause the same as a POST request. So checking for $_REQUEST['submit'] instead of implicitly checking $_POST['submit'] or $_SERVER['REQUEST_METHOD'] could be a violation.

Maybe the author did also mean that the form uses some one-time authentication token so that only authenticated requests are permitted.

answered Oct 26, 2010 at 9:35

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Comments

Repox · Accepted Answer · 2010-10-26 09:23:56Z

0

It seems like the replier didn't think his response through. I would imagine he was thinking there would be some security issues by using $_SERVER["PHP_SELF"], but I can't see how in this case.

As already mentioned, there is nothing wrong with letting the same URL handle different requests.

That said, I still seperate the confirmation message from the form. I see no reason as to why I shouldn't. Validation and error messages can still occur on the form view, but just letting a lot of conditions determine wether you should show the confirmation message, the form or error messages seems like (IMO) your'e getting a lot of messy code.

answered Oct 26, 2010 at 9:23

Repox

15.5k9 gold badges58 silver badges85 bronze badges

Collectives™ on Stack Overflow

PHP Security: send POST to same URL = bad?

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related