2

If I set actions for logged in users to be performed through HTTP methods other than GET or POST, then Javascript HTTP requests respecting the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) is the only way to perform those actions with credentials isn't it? (Since it seems to not be possible with basic HTML.)

2

In modern browsers, requests with methods other than HEAD, GET and POST can't be sent cross-origin without a CORS permission.

If your application verifies that the request method is, say, PUT, an attacker can't forge that request in a CSRF attack, unless you explicitly give permission, e.g. with an Access-Control-Allow-Methods: PUT header.

See also: Examples of access control scenarios

Not the answer you're looking for? Browse other questions tagged or ask your own question.