If functionality on the server side trusts that the HTTP GET method will not allow for a resource representation residing at the URI being accessed to be modified (as per specification of the HTTP GET) and does not provide additional controls to impede such modification, the application will be vulnerable to resource modification and deletion attacks. An application may disallow the HTTP requests to perform DELETE, PUT and POST operations on the resource representation believing that that will be enough to prevent unintended resource alterations. However, there is nothing in the HTTP protocol itself that prevents the HTTP GET method from performing more than just query of the data. For instance, it is a common practice with REST based Web Services to have HTTP GET requests modifying resources on the server side. Whenever that happens however, the access control needs to be properly enforced in the application and no assumptions should be made that only HTTP DELETE, PUT, and POST methods have the power to alter the representation of the resource being accessed in the request.