为什么HTTP删除需要javascript才能起作用？

Question

I was working with Devise in Rails and while setting up the sign_out function I run into errors. I noticed than, it happened because pages which have sign_out link skipped layouts so Javascript was inactive. By enabling javascript with:`

<%= javascript_include_tag :defaults %>

everything just worked fine.

Why does it work like that?

Answer 1

links are (normally) always get requests. In order for a link to send a non-get request you need some javascript that modifies the behaviour of the link.

In addition browsers typically only support GET/POST requests so rails fakes up the other methods (DELETE, PUT,...) by adding a _method field to the post.

Answer 2

Here's excerpt from jquery_ujs.js . It'll shed some light on how it is done:

// Handles "data-method" on links such as:
// <a href="/users/5" data-method="delete" rel="nofollow" data-confirm="Are you sure?">Delete</a>
handleMethod: function(link) {
  var href = link.attr('href'),
    method = link.data('method'),
    target = link.attr('target'),
    csrf_token = $('meta[name=csrf-token]').attr('content'),
    csrf_param = $('meta[name=csrf-param]').attr('content'),
    form = $('<form method="post" action="' + href + '"></form>'),
    metadata_input = '<input name="_method" value="' + method + '" type="hidden" />';

  if (csrf_param !== undefined && csrf_token !== undefined) {
    metadata_input += '<input name="' + csrf_param + '" value="' + csrf_token + '" type="hidden" />';
  }

  if (target) { form.attr('target', target); }

  form.hide().append(metadata_input).appendTo('body');
  form.submit();
},

So, by clicking on such a link you're basically trigger sending of a hidden form (that is being created during the click) with some parameters that simulate DELETE HTTP verb.