If I set actions for logged in users to be performed through HTTP methods other than GET or POST, then Javascript HTTP requests respecting the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) is the only way to perform those actions with credentials isn't it? (Since it seems to not be possible with basic HTML.)


In modern browsers, requests with methods other than HEAD, GET and POST can't be sent cross-origin without a CORS permission.

If your application verifies that the request method is, say, PUT, an attacker can't forge that request in a CSRF attack, unless you explicitly give permission, e.g. with an Access-Control-Allow-Methods: PUT header.

See also: Examples of access control scenarios

Not the answer you're looking for? Browse other questions tagged or ask your own question.