Web applications often let POST requests be run as GET requests without proper checks
When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications
Cryptography and Security
Summary
Some websites are supposed to treat POST requests as actions that change things and GET requests as just looking at things. The authors found that many sites accidentally treat POST and GET requests almost interchangeably, even moving POST data into the URL of a GET request. They created a tool that automatically checks many websites to find when this happens. This mismatch can cause security problems, like allowing tricks that break protections or misuse cached data.
What this means in practice
- •For web security teams: Detect and fix endpoints where POST requests can be replaced by GET requests to close security gaps like CSRF token bypass.
- •For web performance engineers: Identify and manage cacheable GET responses created accidentally by interchangeable POST methods to avoid web cache deception risks.
Authors
Matteo Golinelli, Seif Errahmane Hannachi, Bruno Crispo
Abstract
HTTP method semantics are a common boundary between safe retrieval and state-changing operations; however, deployed web applications do not always enforce this boundary consistently. In this paper, we study HTTP method interchangeability, a behavior where a POST request can be rewritten as a GET request to the same endpoint, with POST body parameters moved into the query string, while preserving an equivalent observed response. We present Method Interchange Detection Engine (MIDE), an automated pipeline that crawls web applications in a browser, records POST requests generated by page loads and user-interface interactions, converts supported POST bodies into GET candidates, and compares replayed responses with the original POST response. To avoid counting generic or parameter-independent responses as interchangeable, MIDE also sends a no-query GET baseline. We treat as high-confidence evidence of interchangeability only the cases where the converted GET matches the POST, while the baseline does not. We perform a large-scale unauthenticated experiment on the Tranco top 10k. We find high-confidence interchangeable requests on 407 of 10,000 tested sites (4.1%), 407 of 3,200 sites with captured POSTs (12.7%), and 407 of 2,734 sites with replayed POSTs (14.9%). A targeted Cross-Site Request Forgery (CSRF) token-replay check finds cases where invalid tokens are rejected for POST but accepted for the equivalent GET. We also observe Web Cache Deception (WCD) conditions and cacheable GET responses for interchangeable request instances. These results demonstrate that method interchangeability is observable in real web applications and can expose method-scoped defense gaps.