GET vs. POST

• HTTP GET requests are not meant to change the state of the application

• • Classic example: http://somehost.com/delete?id=4

• State changes should be done through POST

• This is important to protect against trivial XSRF as well as innocent mistakes like the above