In web-based products from e-commerce stores to email clients to accounting software you often find index pages where each item in a list (or row in a table) has a Delete option. This is often coded as a link… but it shouldn’t be.
I liked this comment by Rails developer Dan where he advises a fellow Rails developer that to create his Delete control he should use a form rather than a link, via Rails’s button_to method.
Dan mentions that in the past Rails UJS set an unsdesirable historical precedent by including a pattern of hijacking links for non-GET reqests.
But per the HTML standard, links are for navigation:
Hyperlinks… are links to other resources that… cause the user agent to navigate to those resources, e.g. to visit them in a browser or download them.
And as Dan goes on to say that’s why links make a GET request.
A GET request is a visit, it says “show me this” and it’s idempotent. When you make the same request it’ll show the same thing.
If on the other hand you want a control that performs an action (in this case request an entity to be deleted) then the appropriate HTML element is usually a button, and in this case a submit button within a form.
Relatedly, Jeremy Keith previously wrote about how to use request methods properly in his excellent post Get safe.