> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Stop Putting Actions on GET Requests! - URL: https://securinglaravel.com/security-tip-stop-putting-actions-on-get-requests/ - Published: 2026-03-17T05:33:42.000Z - Updated: 2026-03-17T05:33:42.000Z - Description: [Tip #128] Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data? - Author: Stephen Rees-Carter - Tags: Security Tips, XSS, HTTP Methods, CSRF ๐Ÿ’ก **Note, I'll just be using* *`POST`* *in this article to keep things simple, but I am talking about all four:* *`POST`* *,* *`PUT`* *,* *`PATCH`* *, and* `DELETE`**.* Let me ask you a question: **What is the difference between `GET` and `POST`?** You're probably thinking something along the lines of: *`GET` requests retrieve data from the server, while `POST` requests send data to the server and perform actions. Links use `GET` requests and forms use `POST` requests.* But what about this question: **What is the technical difference between `GET` and `POST`?** Similar to the above, you're probably thinking: `GET` *requests can be made entirely from a URL and triggered through links, while* `POST` *requests need to be submitted through a form submission, Javascript, or an API request.* While the first answer talks about the flow of data (`GET` \- retrieve, `POST` \- store) and notes that `POST` requests can perform actions, the second answer makes no mention of actions or security in general. Which brings us to the final question: **What is the difference in security between `GET` and `POST`?** *`GET` requests can be triggered from unsafe contexts and should never be trusted to perform actions, while `POST` requests have a lot of protections provided by the browser so you can use them safely (mostly).* Since I think that deserves more of an explanation, let's look at all the ways `GET` and `POST` requests can be triggered maliciously **without** [**Cross-Site Scripting (XSS)**](https://securinglaravel.com/tag/xss/): `GET` requests: 1. Can be triggered by third-party sites through links (``) that the victim clicks on. 2. Can be triggered by third-party sites through resources (``, `