Preliminary research

When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications

Matteo Golinelli, Seif Errahmane Hannachi and Bruno Crispo · arXiv · 27 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Browser-captured POST-to-GET conversion is compared against a no-query GET control to exclude generic responses. Structural equivalence supports measurement of method-policy gaps without claiming demonstrated state change.

Record

Researcher

Matteo Golinelli, Seif Errahmane Hannachi and Bruno Crispo

Published by

arXiv

Date

27 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Code
• Project page

Tags

• http
• csrf
• cache-deception
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Matteo Golinelli, Seif Errahmane Hannachi and Bruno Crispo, first published at the original source. Preserved copies are kept so the citation survives its host.