Details
-
Improvement
-
Status: Closed
-
Normal
-
Resolution: Fixed
-
4.1.0, 13.4.1
-
None
-
Flagged
-
Puma Sprint 226
Description
If the URL as rendered by the <hst:actionURL /> tag is performed as GET request (e.g. by calling the URL from the browser), the components doAction() method is called.
This is unexpected and probably not desirable: we recommend using POSTs for action URLs in [1].
Note that for <form> elements with a method=get atribute, a submit will not lead to calling doAction() because the _hn:type=action parameter is not present in the request (only form parameters are sent).
[1] https://documentation.bloomreach.com/library/concepts/component-development/hst-2-forms.html
Attachments
Issue Links
- relates to
-
HSTTWO-1831 actionURL is hard for infra to support in combination with https filter and proxies
- Closed
-
CMS-12890 By default, only allow POST method for ActionURL
- Closed