Re: GET and POST Methods Accepted

[John GALLET <john.gallet () wanadoo fr>]

Hi there,

> Using GET on a login page for example: The authentication parameters
> shall be logged on the server. Nice way to harvent account info if you
> can get your hands on the logs.

design != runtime.

I totally agree on what you wrote. But the question was : "is there any
reason to check at runtime whether the data was sent over GET or POST".

Everyone agrees it is a design issue and you must be careful not using the
GET method in some cases, basically whenenever sensitive data is sent, but
it is totally useless checking *at runtime* that these choices were indeed
respected by the sending party, for example to detect an intrusion, as is
it so easy to provide your application with the (bad) data in the correct 
(chosen at design) means. 

JG