我可以在没有表格的情况下发送邮件吗？

Question

I'm studying web security.
Form Security During studying, I wonder questions.

Can I send a post without a form?
It does not ask to transfer data to the server without post transmission.
When I send a 'post', I ask if I should go through the 'form'.

Answer 1

You can use XMLHttpRequest to send requests of all types ( POST , GET , ...)

More informationhere .

Answer 2

POSTing in HTML without a FORM didn't work in the browsers I tried it in. Since the FORM element specifies the URL to access, there isn't really complete basis to perform such an operation.

However using curl or a custom HTTP client, it is definitely possible to construct & send handcrafted requests (POST, GET, PUT, DELETE, others) to an HTTP server. These are independent of any HTML pages the server might offer -- the client need never perform a GET -- and can be constructed completely arbitrarily.

For example, a request may specify parameters (eg "order.total", "customer.id", "developmentMode=true") which the web application never offered in the HTML or expected to be received. This can be a potential security hole if eg. automatic binding frameworks are used, and bindable fields should be carefully controlled when using such.

Applications must be robust against such requests as a basic principle of web security.

Answer 3

谷歌浏览器有一个名为“邮递员”的扩展程序，允许发送 HTTP POST 请求： https : //chrome.google.com/webstore/detail/postman/fhbjgbiflinjbdggehcddcbncdddomop?hl=en