Question

I have a “delete file” link on a page:

<form id="myForm" runat="server">
<asp:LinkButton 
    ID="deleteFileLink"
    runat="server"
    OnClientClick="javascript:return confirm('Are you sure?');"
    OnClick="deleteFileLink_Clicked">
        (delete)
</asp:LinkButton>
</form>

I want that link to trigger a POST, never a GET – the page (should) only be accessible to logged in users, but obviously I want there to be no chance that GoogleBot etc. could ever delete a file.

The doc strongly suggests that LinkButton’s always trigger a POST: “The button simply posts the Web page back to the server.”.

Am I reading this right? Is there any chance that this delete link could ever be followed by a non-human user?

Answer 1

Any ASP.NET event occurs through POST and it is widely called PostBack. Although, these PostBack can be simulated using __doPostBack method using JavaScript, but that’s unusual.

Google Bots don’t crawl through PostBack links and there’s good and bad part regarding this.

If you are considering security issue, you should have a logged in flag in your session or somewhere to identify logged in user before you actually execute your delete code .