2

This question already has an answer here:

If I set actions for logged in users to be performed through HTTP methods other than GET or POST, then Javascript HTTP requests respecting the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) is the only way to perform those actions with credentials isn't it? (Since it seems to not be possible with basic HTML.)

marked as duplicate by Steffen Ullrich, Arminius, Anders, Xiong Chiamiov, M'vy Jan 30 '18 at 10:41

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

In modern browsers, requests with methods other than HEAD, GET and POST can't be sent cross-origin without a CORS permission.

If your application verifies that the request method is, say, PUT, an attacker can't forge that request in a CSRF attack, unless you explicitly give permission, e.g. with an Access-Control-Allow-Methods: PUT header.

See also: Examples of access control scenarios

Not the answer you're looking for? Browse other questions tagged or ask your own question.