1

My web application for methods PUT, DELETE and any junk HTTP method return the same response as for GET method (html main page, nothing is uploaded or deleted), for TRACE there is response 405. Is this insecure? Many resources recommends to allow only GET and POST, does this mean that the response should be "405 Method not allowed"?

  • It depends on what your web application is doing. Each HTTP verb should trigger a different action (what happens on your server, not necessarily a different reply to client), if that is not the case, you should not allow anything like PUT or DELETE. – Patrick Mevzek Nov 30 '17 at 17:08
  • 2
    We need a bit more context here. What prompted this question? Is it in relation to some sort of compliance? At face value, returning data with a PUT or DELETE verb would be confusing to someone making that call, but there is nothing inherently insecure about it. – user52472 Nov 30 '17 at 17:09
2

Quite a lot of effectively static sites ignore the HTTP verb used, treating them all as GET, with the exception of HEAD, which only returns the headers for the response. This isn't necessarily a problem, if the site will never make use of the other verbs, but can contribute to a technical debt if you start using them at some point in the future.

For example, if you implemented an API which did allow the replacement of content via PUT requests, using the same code as your main pages, but forgot to restrict the use of PUT to the API, you could end up with people able to edit your main pages. This is a bit contrived, but this kind of thing does happen.

In general, it's just sensible to use an "allowed verbs" approach and to ensure that if you need something different for a particular section of your site, it only works there.

1

My web application for methods PUT, DELETE and any junk HTTP method return the same response as for GET method (html main page, nothing is uploaded or deleted), for TRACE there is response 405. Is this insecure?

Since this is security.SE, not programmers.SE, I'll answer only about how this applies to security: there is no real security implication of choosing 405s vs pretending everything is a GET.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.