HTTP Method Spoofing Checklist

http_method_spoofing_checklist.md

HTTP Method Spoofing Cheatsheet

Overview

HTTP Method Spoofing is when a client sends a request that appears to be a safe or allowed HTTP method (POST, GET), but actually instructs the server-side framework to treat it as a different method (PUT, PATCH, DELETE) via a hidden parameter or HTTP header.

Purpose:

• Originally added to support RESTful routes when HTML forms only supported GET and POST.
• Can be abused if access control is weak.

---

How It Works

Normal REST Requirement:

DELETE /users/123

HTML forms cannot send DELETE directly.

Framework Method Spoofing:

POST /users/123
Content-Type: application/x-www-form-urlencoded

_method=DELETE

Server reads _method and processes as DELETE.

Attacker Abuse:

If access control checks only the HTTP method and not the route, _method=DELETE can be used in POST to delete resources.

---

Common Spoofing Parameters Across Frameworks

Framework	Default Spoofing Parameter	Spoofing Header(s)	Notes
Laravel (PHP)	_method	—	Must be in POST body. Values: PUT, PATCH, DELETE.
Symfony (PHP)	_method	—	Same as Laravel.
Rails (Ruby)	_method	—	Supports PUT, PATCH, DELETE.
CakePHP	_method	—	Works with application/x-www-form-urlencoded.
Express.js (Node.js) + method-override	_method (configurable)	X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override	Can also spoof via query string.
Spring MVC (Java)	_method	X-HTTP-Method-Override	Requires HiddenHttpMethodFilter enabled.
Play Framework (Java/Scala)	_method	—	For form POST only.
Django + django-method-override	_method	—	Needs 3rd-party middleware.
ASP.NET Web API	—	X-HTTP-Method, X-HTTP-Method-Override, X-Method-Override	Often used in APIs.
Flask (Python) + method-override	_method (configurable)	X-HTTP-Method-Override	Needs extension.
Google App Engine	—	X-HTTP-Method-Override	Mostly for JSON APIs.
Backbone.js (client)	_method	—	Sends param in AJAX calls.
CodeIgniter	_method	—	Older versions had quirks.

---

Security Risks

• Bypassing access control for restricted methods.
• CSRF expansion to other HTTP verbs.
• Unexpected behavior if spoofing param is accepted in all requests (incl. GET).

---

VAPT Checklist

1. Test _method, __method__, method params in POST/GET.
2. Test headers:
   • X-HTTP-Method-Override
   • X-HTTP-Method
   • X-Method-Override
3. Check spoofing via query string:

   /endpoint?_method=DELETE
   

4. Confirm if spoofing works with GET requests.
5. Check if CSRF validation happens after method override.
6. Try privileged methods (DELETE, PATCH, PUT) on sensitive endpoints.
7. Inspect middleware or filters (method-override, HiddenHttpMethodFilter, etc.).

---