Page MenuHomePhabricator

Make membership cancellation a POST route
Closed, ResolvedPublic

Description

As a user,
I want to be sure that my intention to apply for a membership is honored and not canceled inadvertently.

Acceptance Criteria:

  • Route cancel-membership-application is only possible with POST
  • Template(s) where the route is used, are adapted

Background:
GET URLs should not trigger side effects on the server. While this is not a problem at the moment, future browsers might try to pre-load the "cancel-membership-application" URL when loading the confirmation page.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Possibly related, but IMHO more important than T182075

I take it this is not as simple as changing $app->get() into $app->post() ?

gabriel-wmde claimed this task.

Was "resolved" by removing this route, we no longer allow user cancellation of memberships