What are HTTP methods (GET, POST, PUT, DELETE…)?

Short answer

The HTTP method states what the client wants to do with the resource specified in the request: GET reads, POST sends data, PUT creates or changes the resource with the sent content, DELETE deletes; HEAD requests only the headers, OPTIONS asks for the options the server supports. The method is written on the first line of the request, before the path (GET /index.html HTTP/1.1). In TR7, the method is a decision criterion in many places: the Method field of the Health Checks profile determines the method of the check request (default GET), the Conditions list of actions contains the ready-made If HTTP method is … conditions, the Allowed Methods field of the CORS action lists the allowed methods, if Ignore HTTP Method Standards in the Cache profile is enabled, the responses of methods such as POST can also be cached, the Allowed Methods field of the WAF rule restricts the methods a page accepts; on the HTTP Logs screen, records are filtered with the Method filter.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks → HTTP / HTTPS profile	Method (default GET)	The method of the health check request
Load Balancer → Actions (Policy Actions) → action form → Conditions	If HTTP method is GET or HEAD, If HTTP method is POST, … (CONNECT, HEAD, OPTIONS, TRACE, DELETE, PUT and the NOT form of each) (relationship with conditions)	Running the action only on requests that come with a specific method
Load Balancer → Actions (Policy Actions) → CORS	Allowed Methods	Informing the browser of the allowed methods
Load Balancer → Profiles (L4-L7 Behavior Sets) → Cache	Ignore HTTP Method Standards (off by default)	Also caching the responses of methods other than GET and HEAD (e.g. POST)
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule form	Allowed Methods: Any Methods (default), Multiple methods, None	Restricting the methods a page accepts
vService → Logs & Tracking → HTTP Logs	Method filter	Filtering records by method
Action value fields → Smart Variables	HTTP Method (↓Method)	Writing the method of the request to a header or a log line

Common Methods

Method	Purpose	Request body
GET	Reading the resource	Has no meaning defined in the standard
HEAD	Getting only the headers of the same response as GET	Has no meaning defined in the standard
POST	Sending data, starting an operation	Carries one
PUT	Creating the resource with the sent content or replacing it entirely	Carries one
PATCH	Partially changing the resource	Carries one
DELETE	Deleting the resource	Has no meaning defined in the standard
OPTIONS	Asking for the supported options; CORS preflight in browsers	Usually does not carry one

The methods are defined in RFC 9110 · Methods, and PATCH in RFC 5789.

Common Misconceptions

• "The method concerns only the application." In TR7, the health check request, action conditions, the CORS response, the cache decision and the WAF rule change depending on the method.
• "GET requests are harmless." An attack payload is also carried with GET, in the query string; WAF inspects GET requests too.
• "WAF restricts methods on every page by default." The default of Allowed Methods in the WAF rule is Any Methods, and no method check is performed; to restrict methods, Multiple Methods is selected and the allowed methods are marked (Can I allow only certain HTTP methods on a page (Allowed Methods)?).

How it is done in the documentation

• Health Checks · Method
• CORS · Allowed Methods
• Caching · Ignore HTTP Method Standards
• WAF Rules · Allowed Methods
• HTTP Logs · Filter

Related questions

• Can I allow only certain HTTP methods on a page (Allowed Methods)?
• How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?
• What is CORS; what is a preflight (OPTIONS) request for?