2 ms·It does because the requirement is only for destructive actionsby wilg 3y agoIt does because the requirement is only for destructive actionsvikramkr 3y agoThe requirement is for POSTs in general, not just deletes. Anything that does actions outside of the system instead of just getting datawilg 3y agoThe wording is ambiguous, but probably should apply. Also the rule should not be based on HTTP verbs at all since that's the wild west.