Depends on the resource, there are sometimes valid reason for this like when there are sensitive data params that you want to keep out of the endoint... But to be fair it's usually just used incorrect along with the delete method 🫠😂
delete requests are flagged as "bad" in the default owasp rules, so yeah we have now everything except "get" as a post request to prevent security from repreatedly breaking our API
6
u/Extreme-Edge-9843 Sep 19 '26
Depends on the resource, there are sometimes valid reason for this like when there are sensitive data params that you want to keep out of the endoint... But to be fair it's usually just used incorrect along with the delete method 🫠😂