5 ms·
That doesn't matter at all in a security context. POST can (and is used) for everything DELETE and PUT are used. Adding DELETE and PUT did not relax anything.
by JanSt 5y ago
That doesn't matter at all in a security context. POST can (and is used) for everything DELETE and PUT are used. Adding DELETE and PUT did not relax anything.
The only question is whether requests are restricted (i.e. in terms of sending resources like cookies).
- goto11 5y agoIf that is the case, then SOP does not restrict anything either, since you can still send cross-origin POST requests under single-origin-policy. I don't think this is a useful way to look at things.
- feanaro 5y agoSOP should primarily be understood as a restriction on reading responses, not making requests.
- SahAssar 5y agoSOP certainly does make restrictions on making requests, like setting any non-default headers (including content-type). It is one of the reasons that validating content-type to not be one of the normal form values used to be a valid way to handle CSRF for APIs.
- FpUser 5y agoOne can use GET as well. It is up to whatever sits behind the browser to interpret request and it can do as pleases. I personally use JSON based RPC in my apps.