pjeweb/geddy — comment on commit fc2ba6fd21f874444ddd657638fef3e662bb7360
File:  line 0
By mde:

This is not safe -- the reason it's traditionally limited to POST is because it's already a destructive method, and it's not possible to do a cross-domain POST from a browser without the user knowing it (XHR doesn't do cross-domain, and image-, style-, and script-tag loads only work with GET). If we implemented this, malicious people could leverage the session-cookies on a (different-domain) Geddy site, and override GETs to secretly do updates, deletions, whatever.