GET parameters working in POST requests using Prototype 1.5.0

rubyonrails-talk
1

Hiall,

I just noticed that in code I wrote quite a while ago I did the following, which actually worked fine:

new Ajax.Request('/foo/bar?param1=foo&param2=bar", { ... })

The thing is, I didn't specify method: get so Prototype issued the default POST request. My rails controller had no problem accessing the parameters via the params hash. Now I'm thinking, is there any reason that rails/prototype didn't complain that I was using GET parameters in my POST request? Should it actually complain or not? Is there any reasonable situation where one would mix POST and GET parameters? I'm a little confused, as my general opinion would be to at least ignore those parameters or even better, give a warning somehow? Or does it simply not matter to mix these and it is therefore ok?

thx in advance Martin Gamsjaeger

2

In your controller, you should have something like the following to limit specific actions to only work as posts.

verify :method => :post, :only => [ :destroy, :create, :update ],          :redirect_to => { :action => 'show' }

Martin Gamsjaeger wrote:

3

in my previous incarnation as a java-dude, I'd often mix GET params inside a POST request - generally for the purposes of authentication.

Prototype will just see it as part of the URL, and Rails is likely parsing it wholesale into params.

Jodi