Yes it is true, the browser will always confirm when you are returning to a page that was the result of a POST. It may not be your case on this page, but it could be a shopping page and then would risk the user sending twice the card data, a purchase, etc.
It’s not very nice to simply try to "circumvent" browser security in this sense. There are some people who try to use the location
, but I don’t think it’s the ideal solution.
If you want to make a website more solid and need to use the POST, read about the strategy Post/Redirect/Get
In short, this strategy makes you work like this, to ensure that the user can use the browser return (and consequently your script as well) without major problems:
- Whenever the server receives a POST, instead of returning the response directly, save the variables and return a 302 (a response header for the browser to redirect to another page)
- This new page works with GET, using the variables already set
- If the user presses the back, it will go back to the GET page
It is a standard behavior of the browser, because the data in POST are not can be sent again without the user’s stunning, imagine if a POST was an UPLOAD, every time the user used the Back would upload again, giving many headaches, to resolve simply change your search to GET, I understand that maybe you want to hide the querystring, but querystring exists for a reason to facilitate the user’s life and even for indexing and even history.
– Guilherme Nascimento