On Wed, May 14, 2014 at 10:43 PM, Valdis Vītoliņš <valdis.vitolins(a)odo.lv> wrote: The add comment form uses POST so why do you say the spammers use GET? Note that even if you 'forge' a GET request you still need to add the CSRF token which you need to get from the HTML form. As for the CommentAddAction that Thomas linked, it works indeed with both POST and GET. Limiting the actions that modify the database to POST is indeed a good thing. Thanks, Marius