OWASPASVS 5.0 requirement

ASVS-V4.1.4 Only http methods that are explicitly supported by the application or its api (including options during preflight requests) can be used and…

L3 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V4 API and Web Service
Section: V4.1 Generic Web Service Security
Level: L3 (requirement applies from this verification level up)

Requirement

Verify that only HTTP methods that are explicitly supported by the application or its API (including OPTIONS during preflight requests) can be used and that unused methods are blocked.