2 ms·
"GET" should not be used for anything that changes state (beyond simple logging of requests). I'm an AppSec engineer and if I were doing a penetration test and
by Sohcahtoa82 4y ago
"GET" should not be used for anything that changes state (beyond simple logging of requests).
I'm an AppSec engineer and if I were doing a penetration test and found that an endpoint was using GET requests for state changes, I'd consider it a serious enough bug to put it on the report, even if it wasn't a security issue.