> I had a client once who had something similar, although unintentionally.
I did that too. I was aware of the problem, but at the time (1996) I did not know how to fix it.
So I just documented it and warned that they should keep the site away from altavista.
This was back before cookies had wide support, so login state was in the URL. If you allowed a search spider to know that URL it would have deleted the entire site by spidering it.
I did eventually fix it by switching to forms, and strengthening the URL token to expire if unused for a while. And then eventually switching to cookies (at one point it supported both url tokens and cookies).
I have not thought about those days in such a long time.
Obviously that is the solution. I know that now, I didn't then. (As I wrote: "I did eventually fix it by switching to forms.")
The whole thing about POST vs GET that everyone knows today for read only vs write was not that well known back then.
Back then you used GET for things with a small number of variables, and POST when you expected enough data that it wouldn't fit in the URL. It was all about the URL, not about the effect of the request.
I guess there was no Wikipedia to have an article for HTTP back then, which has been an invaluable resource for me to understand some of the intricacies in my work.
This site ran on IIS 1.0 on Windows NT 3.51. For scripting we used a prerelease Coldfusion version. (i.e. the version before 1.0, which was released as we were developing the site, partially based on feedback we provided as we tested it.)
> How did you prevent any visitor from deleting the site?
A security token in the url which was secret. The worry was that some admin would try to submit the site to altavista for indexing without removing the token from the url first.
I did that too. I was aware of the problem, but at the time (1996) I did not know how to fix it.
So I just documented it and warned that they should keep the site away from altavista.
This was back before cookies had wide support, so login state was in the URL. If you allowed a search spider to know that URL it would have deleted the entire site by spidering it.
I did eventually fix it by switching to forms, and strengthening the URL token to expire if unused for a while. And then eventually switching to cookies (at one point it supported both url tokens and cookies).
I have not thought about those days in such a long time.