Is it ok to use HTTP GET method that modifies the DB for newsletter confirmation/unsubscribe mails?

Question

I'm implementing a web app that gives the user the ability to subscribe to a "newsletter". Users only need to provide their email address, there is no signup page. To confirm the email address the system sends an email to the given address and asks the users to verify the email address by clicking a link. That links makes a GET requests to the servers and modifies a flag in the model that represents the user's newsletter from confirmed => false to confirmed => true. The problem is that I'm using a GET request that modifies the internal server state and this is bad. The thing is that all system that need email confirmation follow this pattern.

Is there a better way to do this? Should I use Javascript to trigger an Ajax POST request when the users enters the confirmation page in his browser?

Same applies for unsubscribes.

Thanks!

Answer 1

You should not use a GET request for anything that isn't idempotent. Use POST to subscribe for the first time and to change an existing subscription record. Technically, you could use PUT to alter an existing record, but you need to know the record exists already, so it's easier just to always use POST.

To be strict, you could use the GET link to pre-populate a form which you can use JS or a confirmation submit button the user could press on the page to trigger a POST request to your service.