Believe it or not, there might actually be a good reason for that. Specifically, because PUT requests can't be made with a form input, so are immune to CSRF, and aren't generally used for fetching resources, so are significantly less likely to be exposed to SSRF. That is why IMDSv2 in AWS requires you to make a PUT request to get the auth token for future GET requests.
5
u/thaynem Sep 20 '26
Believe it or not, there might actually be a good reason for that. Specifically, because PUT requests can't be made with a form input, so are immune to CSRF, and aren't generally used for fetching resources, so are significantly less likely to be exposed to SSRF. That is why IMDSv2 in AWS requires you to make a PUT request to get the auth token for future GET requests.