Does PUT or DELETE offer any security advantage over GET or POST?

Question

I have a REST API and I want to handle all HTTP requests via POST.

Is there any security issue in using just POST to perform all CRUD operations requested by a user, which sends JSON specifying the operation to be performed (and other informations)?

Answer 1

• The GET (as well as HEAD, OPTIONS and TRACE) is defined as a safe method (RFC 7231, 4.2.1). By this definition you should never use GET to replace PUT, DELETE etc.

• The PUT and DELETE are idempotent methods (RFC 7231, 4.2.2):

A request method is considered "idempotent" if the intended effect on the server of multiple identical requests with that method is the same as the effect for a single such request. Of the request methods defined by this specification, PUT, DELETE, and safe request methods are idempotent.

The POST method doesn't have these restrictions, but keep in mind that Representation State Transfer REST is a software architechtural style. From W3C Working Group Note 11 February 2004, 3.1.3, emphasis is mine:

An even more constrained architectural style for reliable Web applications known as Representation State Transfer (REST) has been proposed by Roy Fielding and has inspired both the W3C Technical Architecture Group's architecture document [Web Arch] and many who see it as a model for how to build Web services [Fielding]. The REST Web is the subset of the WWW (based on HTTP) in which agents provide uniform interface semantics -- essentially create, retrieve, update and delete -- rather than arbitrary or application-specific interfaces, and manipulate resources only by the exchange of representations. Furthermore, the REST interactions are "stateless" in the sense that the meaning of a message does not depend on the state of the conversation.

Therefore, despite using POST in place of PUT and DELETE doesn't have direct security implications, your API wouldn't be RESTful anymore, but an arbitrary application-specific interface.