Form submit hash keys

Jason <[email protected]> Mon, 23 Feb 2009 10:44:21 +0000
Newsgroups gmane.comp.cms.xaraya.devel
Organization Xaraya
Message-ID <[email protected]>
I just had a thought about these hash keys. Submitting a form twice
accidentally, or losing the hash key to a form display in another page, results
in the nasty "keys don't match and now I have thrown all your carefully-entered
data away, have a nice day" error.

Instead, would it make sense to just redisplay the page, with the submitted data
intact, and a message to telling the user that their data was *not* submitted
and to try again?

Are there any security flaws with such an approach? I can't think of any, but it
would make forms a lot more friendly.

The keys are supposed to stop a well-formed URL from submitting a form without
the administrator (or other privileged user) realising it. By re-presenting the
submitted data as a form, this requirement would still be met.

-- Jason