title: Form keys (CSRF) in CakePHP
body: <p>I have seen in some MVC applications the use of Token keys to prevent CSRF. A typical example of where it may be used is on the delete method for a post.</p>
  
  <p>And I've seen implementations using both GET and POST methods.</p>
  
  <p>An example GET request link with a token:</p>
  
  <p><code>https://domain.com/posts/G7j/delete/EOwFwC4TIIydMVUHMXZZdkbUR0cluRSkFzecQy3m5pMTYVXRkcFIBWUZYLNUNSNgQKdnpTWu</code></p>
  
  <p>And an example of a POST request with a token:</p>
  
  <pre><code>&lt;form action="/posts/G7j/delete" method="post"&gt;
      &lt;input type="hidden" name="token" value="EOwFwC4TIIydMVUHMXZZdkbUR0cluRSkFzecQy3m5pMTYVXRkcFIBWUZYLNUNSNgQKdnpTWu" /&gt;
      &lt;button type="submit"&gt;Delete&lt;/button&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>I've been looking into implementing this into my CakePHP applications based on the documents: <a href="http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html" rel="nofollow">http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html</a></p>
  
  <p>And according to the documents, adding the Security component auto adds the form key to all forms that use the Form Helper.</p>
  
  <p>e.g.</p>
  
  <pre><code>public $components = array(
      'Security' =&gt; array(
          'csrfExpires' =&gt; '+1 hour'
      )
  );
  </code></pre>
  
  <p><strong>However I have some questions:</strong></p>
  
  <p>1.) Why use POST over GET for some actions such as delete? As the request in the controller will check if the user is authenticated, has permission, and that it has the correct form key.</p>
  
  <p>2.) How can I use the security component with a GET request in CakePHP? Presume I would also need to handle the routing as well.</p>