Embed Notice

@dangoodin @ryanc I mean, it's a constraint for sure (e.g. the POST will be forms-encoded instead of, say, JSON like a green developer writing a service today might write code to expect) but risk will depend on the specific target. A soft target might even be susceptible to GET alone.

Car analogy: We discovered that leaving keys inside the car, even out of sight, is vulnerable because thieves can still use coat hangers to pop the locks. Non ignition-key mitigations like The Club are unaffected.