jsr340-experts@servlet-spec.java.net

[jsr340-experts] Re: [servlet-spec users] Re: security concern (protocol parameter parsing order)

From: Greg Wilkins <gregw_at_intalio.com>
Date: Wed, 11 Jul 2012 10:33:09 +0200

On 10 July 2012 20:57, Jeff Williams <jeff.williams_at_aspectsecurity.com> wrote:
> So if the API doesn't change, what exactly what are developers supposed
> to do? Rewrite their app so that the form and form-handler are
> different URLs? That seems extremely painful.

All developers need to do is to specify the form handling URL and not
let it default to the page URL. The URL can be specified to be
exactly the form URL or something different, so the structure of the
webapp does not need to change.

If any action should be taken, perhaps it should be suggested to the
W3C that HTTP spec bechanged so that default form targets should not
include the query parameters?

-- 
Greg Wilkins <gregw_at_intalio.com>
www.webtide.com
Developer advice, services and support
from the Jetty & CometD experts.