Timeline for Why should someone block all methods other than GET and POST in a RESTful application?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 17, 2018 at 14:53 | comment | added | usr-local-ΕΨΗΕΛΩΝ | "Or maybe they just disabled all methods they did not need". That is a very good point, but not applicable to my case. I mean, if you are a software company you can reasonably take such decision. But if you are a bank running your supplier's code, it's not you who decide which methods to use. Thanks for the opinion! | |
| Dec 15, 2018 at 13:17 | comment | added | usr-local-ΕΨΗΕΛΩΝ | If you implement CSRF using a good framework (e.g. Spring Security in my case, but can also be [AntiForgeryTokenAttribute]), that will be applied to all verbs than GET. In my case I happened to configure Angularjs to send the token header also on GET requests. Has no effect but is shorter configuration | |
| Dec 15, 2018 at 2:46 | history | answered | Tgr | CC BY-SA 4.0 |