Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
2 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

If this is a privileged function that should not be executed by just anyone, then you need to protect your function by also checking the identity of the user (e.g. session id).

Furthermore you should make sure that you have a CSRF token, if someone were to send a link to one of your users with that GET request and the user opens it, he might end up executing a function he didn't want to execute.

Now depending on what your function does and what the GET parameter is, "hackers" might find out what it does.

It might be that your function only shows information (immutable) than this can be ok. I would like to refer to this question: http://security.stackexchange.com/questions/29449/how-unlikely-is-it-that-a-google-doc-link-is-guessedHow unlikely is it that a Google Doc link is guessed?

If this is a privileged function that should not be executed by just anyone, then you need to protect your function by also checking the identity of the user (e.g. session id).

Furthermore you should make sure that you have a CSRF token, if someone were to send a link to one of your users with that GET request and the user opens it, he might end up executing a function he didn't want to execute.

Now depending on what your function does and what the GET parameter is, "hackers" might find out what it does.

It might be that your function only shows information (immutable) than this can be ok. I would like to refer to this question: http://security.stackexchange.com/questions/29449/how-unlikely-is-it-that-a-google-doc-link-is-guessed

If this is a privileged function that should not be executed by just anyone, then you need to protect your function by also checking the identity of the user (e.g. session id).

Furthermore you should make sure that you have a CSRF token, if someone were to send a link to one of your users with that GET request and the user opens it, he might end up executing a function he didn't want to execute.

Now depending on what your function does and what the GET parameter is, "hackers" might find out what it does.

It might be that your function only shows information (immutable) than this can be ok. I would like to refer to this question: How unlikely is it that a Google Doc link is guessed?

1
source | link

If this is a privileged function that should not be executed by just anyone, then you need to protect your function by also checking the identity of the user (e.g. session id).

Furthermore you should make sure that you have a CSRF token, if someone were to send a link to one of your users with that GET request and the user opens it, he might end up executing a function he didn't want to execute.

Now depending on what your function does and what the GET parameter is, "hackers" might find out what it does.

It might be that your function only shows information (immutable) than this can be ok. I would like to refer to this question: http://security.stackexchange.com/questions/29449/how-unlikely-is-it-that-a-google-doc-link-is-guessed