I’m using the PRG pattern to avoid multiple form submission. It has, however, a serious drawback — you cannot simply echo the confirmation message to the user (
Coming very late to this discussion..
You could use a combination of the two proposed options.
After the POST request the client is redirected (303) to an URL indicating that there could be a response message for this request:
Client: GET http://example.com/foo.cgi
Server: 200 Ok
Client: POST http://example.com/bar.cgi
Server: 303 http://example.com/foo.cgi?msg=true
If the msg argument is true the message will be looked up in the session and (if found) included in the response to the client.
If the msg argument is ! true (or not present), the lookup step is skipped.
With this solution, you prevent the actual message being show in the URL, the URL only indicates there could be a message. Also, the message is only shown when needed (=when found in the session).
Another advantage is that this solution also allows for proper cash-controls to be included with HTTP responses.