Return-Path: <random832@fastmail.us>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.006
X-Spam-Evidence: '*H*': 0.99; '*S*': 0.00; 'cache': 0.07; 'needed,': 0.07; 'session.': 0.07; 'assumed': 0.09; 'cherrypy': 0.09; 'latter': 0.09; 'received:internal': 0.09; 'refresh': 0.09; 'subject:Cherrypy': 0.09; 'caches': 0.16; 'message- id:@webmail.messagingengine.com': 0.16; 'received:10.202': 0.16; 'received:10.202.2': 0.16; 'received:66.111': 0.16; 'received:66.111.4': 0.16; 'received:66.111.4.27': 0.16; 'received:messagingengine.com': 0.16; 'received:out3-smtp.messagingengine.com': 0.16; 'wrote:': 0.18; 'all,': 0.19; 'app': 0.19; 'trying': 0.19; 'typing': 0.19; 'admin': 0.22; 'mon,': 0.24; 'least': 0.26; 'skip:" 20': 0.27; 'header:In-Reply-To:1': 0.27; 'dec': 0.30; 'skip:( 20': 0.30; 'request,': 0.31; 'actual': 0.34; 'could': 0.34; 'problem': 0.35; 'received:66': 0.35; 'etc': 0.35; 'acceptable': 0.36; 'example,': 0.37; 'received:10': 0.37; 'server': 0.38; 'form,': 0.38; 'to:addr :python-list': 0.38; 'to:addr:python.org': 0.39; 'how': 0.40; 'even': 0.60; 'tell': 0.60; 'from:no real name:2**0': 0.61; 'browser': 0.61; 'strictly': 0.61; 'header:Message-Id:1': 0.63; 'skip:n 10': 0.64; 'side': 0.67; 'between': 0.67; 'designers': 0.74; '2014,': 0.84; 'harmful': 0.84; 'effects.': 0.91; 'serious': 0.97
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=fastmail.us; h= message-id:x-sasl-enc:from:to:mime-version :content-transfer-encoding:content-type:subject:date:in-reply-to :references; s=mesmtp; bh=gUgykp6Ug7E5B93Har6Z3x0Lu9k=; b=Gef7S0 qpH/3exrS9/OA/J5vUkOv/ENciYZI/eVydCej4+amg8PuSbFZkku5CaaYFv9AiG2 V3FukjQWsEfnE2F1pjNDfnDX4L3BZ4JzQklm9tdY0LcUKi/27hmMskE6axmvnZ2o 58hsqEqv3Iz0ZPCWbO5ESlbyi0wK5i5Pe3vik=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=message-id:x-sasl-enc:from:to :mime-version:content-transfer-encoding:content-type:subject :date:in-reply-to:references; s=smtpout; bh=gUgykp6Ug7E5B93Har6Z 3x0Lu9k=; b=Cp4Kwr2YvLqvkA8nhehk8sUmflkz0Zb6OEBu1LOE9nucAR2QHA4t jcuch6LNdXnplSt6eyNGzsDf8u0bXiN/NWmj4ygZCt0kKVxSBZOIgkdUVFcX83xg PcigHsiNU2zG9xSKV7S7aDMGIpOKsHoY8yr+w4d/GkSDl5o7htGzSYw=
X-Sasl-Enc: S8Ije0OnKr7m6x953WAVIu6M0earXIm3JLuUL/3vo6wr 1417527181
From: random832@fastmail.us
To: python-list@python.org
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
X-Mailer: MessagingEngine.com Webmail Interface - ajax-53201334
Subject: Re: Cherrypy - prevent browser "prefetch"?
Date: Tue, 02 Dec 2014 08:33:01 -0500
In-Reply-To: <6B74D6DD-A597-4BCF-8586-D0A56C9CDB77@ravnalaska.net>
References: <6B74D6DD-A597-4BCF-8586-D0A56C9CDB77@ravnalaska.net>
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.16493.1417527184.18130.python-list@python.org>
Lines: 16
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1417527184 news.xs4all.nl 2929 [2001:888:2000:d::a6]:34718
X-Complaints-To: abuse@xs4all.nl
Path: csiph.com!usenet.pasdenom.info!bete-des-vosges.org!feed.ac-versailles.fr!nerim.net!novso.com!newsfeed.xs4all.nl!newsfeed2a.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Xref: csiph.com comp.lang.python:81802

On Mon, Dec 1, 2014, at 15:28, Israel Brewster wrote:
> For example, I have a URL on my Cherrypy app that updates some local
> caches. It is accessed at http://<server>/admin/updatecaches So if I
> start typing http://<server>/a, for example, safari may auto-fill the
> "dmin/updatecaches", and trigger a cache refresh on the server - even
> though I was just trying to get to the main admin page at /admin. Or, it
> might auto-fill "uth/logout" instead (http://<server>/auth/logout), and
> log me out of my session. While the former may be acceptable (after all,
> a cache update, even if not strictly needed, is at least non-harmfull),
> the latter could cause serious issues with usability. So how can cherrypy
> tell the difference between the "prefetch" and an actual request, and not
> respond to the prefetch?

Why is your logout form - or, your update caches form, etc - a GET
instead of a POST? The key problem is that a GET request is assumed by
browser designers to not have any harmful side effects.