Unit 2: URLs, methods and redirects · Lesson 2 of 5 · 15 min
Methods
GET reads, POST submits, and a server should refuse the methods it never needs.
mission
- You are
- The analyst reviewing the shop.
- Situation
- A scanner report says the shop might accept PUT and DELETE. Scanners guess, so you check by hand.
- Goal
- Find out which methods each page accepts and how it refuses the others.
- Hand in
- One line per method with the status the shop returns.
Safe and unsafe methods
- GET, HEAD, OPTIONSRead only. Must never change anything on the server.
- POST, PUT, PATCH, DELETEChange state. Need authentication and protection against cross-site requests.
Methods you will meet
| Command | What it does |
|---|---|
GET | Fetch a resource. Should never change anything |
HEAD | Like GET, headers only |
POST | Submit data, such as a form |
PUT, PATCH, DELETE | Replace, change or remove. APIs use them; plain pages should refuse them |
OPTIONS | Ask what is allowed. Browsers send it before some cross-site requests |
Try every method on one page
for m in GET POST PUT PATCH DELETE OPTIONS; do printf '%-8s ' $m; curl -s -o /dev/null -w '%{http_code}\n' -X $m http://127.0.0.1:8000/; done
GET 200
POST 405
PUT 405
PATCH 405
DELETE 405
OPTIONS 405
you should see GET works. Everything else is refused with 405.
defender tip Test HEAD with curl -I, not -X HEAD. With -X HEAD curl waits for a body that never comes.
Read the refusal
curl -si -X DELETE http://127.0.0.1:8000/ | head -n 6
HTTP/1.1 405 Method Not Allowed
Server: shop/1.4
Date: Wed, 14 Oct 2026 09:00:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 265
Allow: GET, HEAD
you should see 405 with an Allow header listing the methods the page does accept.
Find where POST is welcome
Forms need POST. The sign-in page is the only one that takes it.
curl -s -o /dev/null -w '%{http_code}\n' -X POST -d 'user=x&password=y' http://127.0.0.1:8000/login
401
you should see 401: the method is accepted, the password is not.
Ask the API what it allows
Browsers send OPTIONS before some cross-site requests. The answer lists the methods the server accepts.
curl -si -X OPTIONS http://127.0.0.1:8000/api/products | grep -iE '^(HTTP|access-control-allow-methods)'
HTTP/1.1 204 No Content
Access-Control-Allow-Methods: GET
you should see 204 and GET only. An API that answers OPTIONS with every method deserves a closer look.
A good refusal
HTTP/1.1 500 Internal Server Error
The app crashed on a method it did not expect.
HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD
The page says no and lists what it supports.
What a defender takes away
- 1Pages that only serve content should accept GET and HEAD and nothing else.
- 2405 with an Allow header is the right refusal.
- 3Check scanner claims by hand before they reach a report.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.