Re: "Warning: Page has Expired" - How to aviod when using browserback button?

From: Philip Ronan (invalid_at_invalid.invalid)
Date: 02/19/05 

Date: Sat, 19 Feb 2005 11:12:48 +0000

Janwillem Borleffs wrote:

> Philip Ronan wrote:
>> 1. The visitor's browser will have to submit the POST data twice
>
> Only when the submit button is hit again. The page itself, with the
> prefilled values, is retrieved from the browser cache.

No, I mean when you send a "Location" header [1] back to the client, it has
to resubmit the POST data to the new URL. But you can't actually rely on
this happening anyway because...

>> 2. Browser support for POST redirects is rather unreliable (see
>> http://ppewww.ph.gla.ac.uk/~flavell/www/post-redirect.html)
>
> I'm aware of the caveats, but I have found this method to be reliable enough
> in most cases.

That sounds like the sort of argument used to support the use of "mailto:"
as a form action. If you're not complying with the standards, then you're
asking for trouble. Sending a "Location" header with PHP simply isn't good
enough.

You also seem to have missed the URL I referrer to earlier on in this
thread: <http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.10>

Once data has been submitted by the POST method, it immediately becomes
stale. So it shouldn't be cached anywhere, even in your browser's local
cache. I can't see how redirecting the request should make any difference.

[1] Actually you should also be sending a "HTTP/1.1 307 Temporary redirect"
header. If you just send a "Location" header by itself, PHP generates a "302
Found" response, which asks the client to send a GET request to the new URL.
That means the POST data will all be lost. 

-- 
phil [dot] ronan @ virgin [dot] net
http://vzone.virgin.net/phil.ronan/