Allow Get request but only in my domain?

Question

On my site i can trigger certain things using GET request like the ability to hide or delete a comment. I am not very worried but it would be pretty annoying if someone design a

Answer 1

The risk you're discussing is known as a cross-site request forgery attack. The standard way to prevent it is to double-post cookies (once in the cookies, once in the form), or some other unique token that an attacker could not guess via an included image. For more details on detection and prevention, see:

http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)