HTTP Verb tempering using MITM attack possibilities and prevention in rest api.
If an application URL is dependent only on http method to determine it's action, how can we reduce impact of tempering by someone using MITM techniques?
For example, GET /xyz/ displays the show page of entity to requester while DELETE xyz/ can delete the page. The concern is, if an admin user request for show page and someone in the middle changes method to Delete, page will get deleted.
Both requests needs same authentication token so the attacker, sitting in the middle, will only have to change method and entity will get deleted.
How can we reduce possibilities of such scenarios? Will a confirmation message be enough or some other measures should be applied?