facebook/tornado — pull request #599 by xethorn (2012-09-30 23:21:42+00:00)
Title: Add support for argument origin

Hello,

The request (HTTPRequest) is providing a unique attribute (arguments) which contains all the arguments regardless of their origin. It's thus not possible to determine where each of them has been set and defined.

I think it would be nice to be able to make a distinction somewhere about those two origins. It would also help to avoid situation where some parameters that should only be sent in the body are entered in the url. It could also help to detect fraudulent accesses (e.g. the xsrf should never be part of the url.)

In the update I've made, I added two things to HTTPRequest:
• url_params: the GET params.
• form_params: the POST params.

Initially, I thought of using self.get, self.post, but seems confusing since the request handler is already using them. get_arguments doesn't work either since a function of the same name already exists. :-/ Let me know what your thoughts are!

Looking forward,
Mike