Web Security · Junior · Question 31 of 75

Why must a GET request never change data (for example `GET /delete?id=5`)?

✓Correct answer: GET can be triggered by a simple <img> tag or link, and caches and prefetchers may call it on their own
2Because servers ignore GET requests from browsers
3Because GET requests can't carry query parameters

Explanation

Safe methods like GET should only read. State changes belong in POST, PUT, PATCH or DELETE with CSRF protection.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.