Hello @XcrigX
welcome to the community !
It could be a great improvement, more generally this rule should raise only if a developer mixes safe and unsafe HTTP methods:
- Description of common safe methods:
GET,HEAD,OPTIONS - Description of common unsafe methods:
PUT,DELETE,POST
Unsafe methods are used to change the state of an application, thus they are sensitive operations, but this guideline is not often followed for example another user reported to us that OpenID connect uses both GET and POST methods to simply retrieve some information. Thus, we will also change the issue type of this rule to security-hotspot with all the explanations for developers to help them during the review.
Eric