Many sites let POST requests be rewritten as GET, exposing CSRF and cache defenses
The claim
The authors assert that POST requests can be converted to GET requests with equivalent responses on a notable fraction of popular web sites
Published as: “When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications”
So what
Method interchangeability can bypass CSRF token checks and expose dynamic content to caching, creating new attack surfaces for cross-site request forgery and cache-based data leakage.
The five-minute version
High-confidence HTTP method interchangeability is observed on 4.1% of all tested sites (407 of 10,000), affecting 12.7% of sites with captured POSTs and 14.9% of sites with replayed POSTs. Among 115 token-bearing requests, 7 cases across 2 sites show that POST requests reject invalid CSRF tokens while the equivalent GET accepts them. Method interchangeability also leads to cacheable dynamic responses: 56 request instances (4.6%) across 9 sites (2.2%) yielded a WCD-style cache hit. The evidence is based on a large-scale unauthenticated crawl of the Tranco top-10k with a baseline-controlled comparison, but the measurement is a lower-bound due to crawl limits and deny-listing.
What they found 3
- Method interchangeability is present on 4.1% of all tested sites and up to 14.9% of sites with replayed POSTs.
“We find method interchangeability on 407 of 10,000 tested sites (4.1%), 407 of 3,200 sites with captured POSTs (12.7%), and 407 of 2,734 sites with replayed POSTs (14.9%).”
- Some POST endpoints reject invalid CSRF tokens while the equivalent GET accepts them.
“POST rejects; GET accepts 7 (6.1%)”
- Method-interchangeable endpoints can become cacheable, with 56 request instances causing WCD-style cache hits.
“Overall, 56 request instances (4.6%) across 9 sites (2.2%) had at least one WCD payload-induced cache hit.”
What undercuts it the paper’s own results
- A large proportion of apparent equivalences are ambiguous: 1,782 (59.2%) are class B ambiguous cases where the no-query GET matches the POST response as well as the converted GET.
- The measurement is unauthenticated and limited to a subset of pages/forms, so the reported prevalence is a lower bound.
Stated limits 4
- Our crawler uses a strong denylist for potentially destructive or state and session-changing actions and file uploads. This reduces the risk of side effects on live sites, but it means that the POST population we collect is a lower bound.
- The measurement is unauthenticated and therefore does not cover functionality available only after login.
- Coverage is further bounded by the 10-page and depth-5 crawl limits and the caps of 5 forms and 10 standalone buttons per page.
- The crawler triggers selected form and button interactions rather than exhaustively exploring all event types and UI states, while its benign synthetic inputs may fail application-specific validation or miss behaviors that depend on realistic user data.
What’s new here 4
- First large-scale, baseline-controlled measurement of HTTP method interchangeability in the wild.
- Introduces MIDE, a browser-based pipeline that rewrites POST bodies to GET query strings and validates response equivalence against a no-query GET baseline.
- Quantifies security-relevant gaps: method-scoped CSRF token validation failures and Web Cache Deception cacheability.
- Provides open-source tooling and configuration for reproducible detection.
Artifacts & methods 5
- Method Interchange Detection Engine (MIDE)system
- Tranco top-10k listdataset
- Baseline-controlled response equivalence comparison
- CSRF token replay analysis
- Web Cache Deception payload testing