HTTP (Hypertext Transfer Protocol) methods define what action a client wants to perform on a web server. Understanding HTTP methods is not only essential for web development, but also critical for web application security, API security, and penetration testing.
This post provides a deep technical explanation of core HTTP methods along with real-world security risks, attack vectors, and best practices, exactly aligned with the reference diagram.
Why HTTP Methods Matter in Security
Many critical vulnerabilities exist not because of bugs, but because HTTP methods are:
- Misused
- Improperly restricted
- Incorrectly validated
Attackers abuse HTTP methods to perform:
- Unauthorized data access
- Privilege escalation
- Mass assignment attacks
- CSRF and IDOR exploits
GET Method (Retrieve Data)
The GET method is used to request data from a specified resource. It should be read-only and must not change server state.
Purpose
- Fetch data from the server
- Retrieve resources such as user profiles, lists, or records
Example
GET /api/users?id=123
Expected Response
- 200 OK
- JSON or HTML data
Security Considerations
- Data Exposure: Sensitive data in URLs appears in browser history, logs, and referrer headers.
- Caching Risks: GET responses may be cached by browsers and proxies.
- CSRF: GET requests should never perform state-changing actions.
Best Practice: Never use GET for authentication, password resets, or data modification.
POST Method (Submit Data)
The POST method sends data to the server to create or process a resource. Data is included in the request body.
Purpose
- Create new resources
- Submit form data
- Trigger server-side actions
Example
POST /api/users
Body: { "name": "Alice" }
Expected Response
- 201 Created
Security Considerations
- CSRF: POST is highly vulnerable without anti-CSRF tokens.
- Injection Attacks: Poor validation can lead to SQLi, XSS, and command injection.
- Data Integrity: Always enforce HTTPS to prevent tampering.
Best Practice: Use input validation, CSRF tokens, and strict schema validation.
PUT Method (Update or Replace Resource)
The PUT method updates an existing resource or creates it if it does not exist. It replaces the entire resource.
Purpose
- Full update of a resource
- Replace all existing fields
Example
PUT /api/users/123
Body: { "name": "Bob", "role": "admin" }
Expected Response
- 200 OK
Security Considerations
- Authorization: Strict role-based access control is required.
- Mass Assignment: Attackers may modify sensitive fields (e.g., role).
- Idempotency: Multiple identical requests must produce the same result.
Best Practice: Explicitly whitelist updatable fields.
DELETE Method (Remove Resource)
The DELETE method removes a specified resource from the server.
Purpose
- Delete records
- Remove accounts or data
Example
DELETE /api/users/123
Expected Response
- 204 No Content
Security Considerations
- Strict Authorization: Only privileged users should delete resources.
- CSRF: DELETE endpoints must be protected.
- Audit Logging: Deletions should always be logged.
Best Practice: Use soft deletes when possible and enforce audit trails.
PATCH Method (Partial Update)
The PATCH method applies partial updates to a resource instead of replacing it completely.
Purpose
- Update specific fields
- Efficient resource modification
Example
PATCH /api/users/123
Body: { "role": "manager" }
Expected Response
- 200 OK
Security Considerations
- Complex Validation: Partial updates increase logic complexity.
- Mass Assignment: Similar risks as PUT.
- IDOR: Ensure the user owns or is authorized to modify the resource.
Best Practice: Validate ownership and allowed fields strictly.
HTTP Methods & Common Attacks
| Method | Common Attacks |
|---|---|
| GET | Data leakage, IDOR, cache poisoning |
| POST | CSRF, SQL Injection, XSS |
| PUT | Mass assignment, privilege escalation |
| DELETE | Unauthorized deletion, CSRF |
| PATCH | IDOR, logic flaws |
HTTP Methods in OWASP & API Security
Misuse of HTTP methods is directly related to:
- OWASP A01 – Broken Access Control
- OWASP A03 – Injection
- OWASP API Top 10 – Mass Assignment
- OWASP API Top 10 – IDOR
Best Practices for Secure HTTP Method Usage
- Enforce authentication and authorization per method
- Never trust client input
- Implement CSRF protection
- Use HTTPS everywhere
- Log sensitive actions (PUT, DELETE)
- Apply least privilege principles
Why This Knowledge is Critical
Understanding HTTP methods deeply is essential for:
- Web developers
- API engineers
- Penetration testers
- Bug bounty hunters
- Cybersecurity students
Conclusion
HTTP methods define how the web works — and how it breaks. Most serious web vulnerabilities occur when developers misunderstand the purpose and security implications of HTTP methods.
Secure APIs start with correct HTTP method design.
Understand the method. Secure the action. 🔐
