There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This request will be approved by server and associated action will be done. I know that it's recommended not to allow GET requests to prevent CSRF attacks. But tokens should be submitted to make action executed.
Should urls that are normally operated using POST requests accept only POST requests?