Timeline for What is a typical response from webserver for POST request?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 2, 2019 at 15:24 | comment | added | Franklin Yu | I believe the security team is talking about session history. This is in memory, so it will be cleared when closing the browser. | |
| Mar 11, 2017 at 0:01 | comment | added | Lie Ryan | Using a redirect after post prevents duplicate submissions, but won't prevent the browser from remembering field values. | |
| Mar 10, 2017 at 19:26 | comment | added | Ajedi32 | Usually I like to use a 303 in response to a POST request, but that has nothing to do with security. It's just a UX consideration that prevents the browser from prompting the user about whether they want to re-send the POST when they click refresh. Perhaps that's what the security team was referring to? | |
| Mar 10, 2017 at 17:37 | answer | added | Josey Wales | timeline score: 1 | |
| S Oct 16, 2015 at 5:33 | history | suggested | Jeroen | CC BY-SA 3.0 |
Make it better readable by adding paragraphs; Fixed some typo's and used some capitals here and there.
|
| Oct 16, 2015 at 5:00 | review | Suggested edits | |||
| S Oct 16, 2015 at 5:33 | |||||
| Oct 15, 2015 at 20:42 | answer | added | Brilliand | timeline score: 0 | |
| Oct 15, 2015 at 20:21 | comment | added | gowenfawr | That's not actually the request, that's the browser cacheing of input fields, which is a third kettle of fish yet. You can gently suggest the browser not remember those fields using autocomplete flag in the form or field definitions. However, whether the browser actually listens or not is another question - it's complex, and the answer is "don't depend on it." | |
| Oct 15, 2015 at 20:19 | comment | added | Neil Smithline | Hard to respond to the question without understanding exactly what is being attempted. Have you tried a quick mock-up to see how browsers behave? Perhaps you could use that to prove or disprove the security team's idea. | |
| Oct 15, 2015 at 20:15 | comment | added | DoodleKana | "The application does not prevent caching of confidential information. Upon submitting a form, it is possible to hit the back button in the browser, then the refresh button to view the information that was submitted." This is what they said. To me that sounds like the request. I am not sure. | |
| Oct 15, 2015 at 20:10 | comment | added | Neil Smithline | Are you concerned with caching of the POST response data or of the form that was filled in for the POST? | |
| Oct 15, 2015 at 19:58 | answer | added | Steffen Ullrich | timeline score: 1 | |
| Oct 15, 2015 at 19:57 | answer | added | Zonk | timeline score: 1 | |
| Oct 15, 2015 at 19:40 | answer | added | gowenfawr | timeline score: 4 | |
| Oct 15, 2015 at 19:20 | history | asked | DoodleKana | CC BY-SA 3.0 |