Topic · DiggingBeagle record

HTTP method is not an egress boundary

HTTP verbs describe request semantics expected by clients and servers; they do not enforce data-flow direction. A receiver can persist information carried in a GET path or query string, so allowing arbitrary outbound GET while blocking POST, PUT or conventional uploads does not create a read-only security boundary.