title: Are some HTTP verbs really inherently less secure than others?
body: <p>Someone pointed me to this article</p>
  
  <p><a href="http://resources.infosecinstitute.com/http-verb-tempering-bypassing-web-authentication-and-authorization/" rel="nofollow">http://resources.infosecinstitute.com/http-verb-tempering-bypassing-web-authentication-and-authorization/</a></p>
  
  <p>Which seems to be saying that all HTTP verbs other than GET and POST are inherently less secure, and should be disabled in the web server configuration.</p>
  
  <p>It looks to me that the arguments of the article are completely bogus, and are based on an assumption that the underlying web platform performs less stringent checking for other verbs than it does on GET and POST.</p>
  
  <p>I realise that by following the principle of least privilege and only opening up the verbs you need, the attack surface is reduced, but is there really any validity in the argument that some verbs are inherently less secure, and that I should to avoid use of PUT and DELETE in a REST application for instance?</p>
  
  <p>FWIW my platform is ASP.NET with a mixture of web forms and MVC.</p>