Why is the Post/Redirect/Get pattern not sufficient on its own to prevent double-click duplicate submissions?

Post/Redirect/Get solves a specific, later problem: it stops a browser from re-issuing the original POST when the user refreshes the page or clicks back after the first submission already completed and redirected. Because the address bar now shows a GET URL, a refresh just re-fetches that GET, not the original POST.

Double-clicking a submit button is a different, earlier problem. Both clicks fire before the server has had a chance to process and redirect from the first one - two POST requests are dispatched to the server essentially back to back, often only milliseconds apart, well before any redirect response exists to protect against. PRG has nothing to say about that window at all, since by definition it only comes into play after a successful redirect has already happened.

That's why a double-click specifically needs either a client-side safeguard (disabling the button immediately) or a server-side one that can reject a second concurrent request before it's fully processed (a synchronizer token invalidated on first use, or an idempotency key check) - PRG addresses the resubmission case, not the concurrent-double-dispatch case.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.