Question

The ASP.NET MVC pattern of submitting forms via post, then redirecting to the same or different URL is very easy to code.

Imagine this scenario:

1. User goes to /products/42/edit to view and edit product 42.
2. They see something crazy on that page, edit it, and hit save. This causes a POST to /products/42/edit
3. The action updates the data and redirects to or returns the view for /products/42/edit
4. The user sees the updated data and is happy.
5. One hour later they click refresh to see if anyone else has messed with product #42.
6. Because the last retrieval for /products/42/edit was a POST, their browser asks to resubmit the form data. This is annoying and dangerous because it can overwrite someone else’s data.

I fear that even if I use two different URLs for the POSTs and GETs (say /products/42/edit and /products/42), that the browser will still ask for the repost and can destroy data. Am I mistaken?

What alternative methods can be used so that after submitting product changes, the user can safely hit refresh to get an updated view?

Update I see now that my question and my design were muddled, my apologies for that. I see that it was a bad idea for me to share URLs (actions) between the POST and the GET. Am I right to assume then that if those two are different, then I won’t have the “refresh causes rePOST” problem?

Answer 1

To your update: yes.

Use /product/{id}/ for viewing, and /product/{id}/edit for editing, and after the edit, redirect them to /product/{id}/.

Problem solved. Was wondering why you are/were using /product/{id}/edit for both viewing and editing.