From 08a89209e8abe2f9f49160646109c7ba7e522986 Mon Sep 17 00:00:00 2001
From: Christian Wolf <github@christianwolf.email>
Date: Mon, 20 Jan 2025 17:33:28 +0100
Subject: [PATCH] Add some paragraph on GET vs other verbs in HTTP

Signed-off-by: Christian Wolf <github@christianwolf.email>
---
 developer_manual/prologue/security.rst | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/developer_manual/prologue/security.rst b/developer_manual/prologue/security.rst
index c9c1081b1..c68d8fa2f 100644
--- a/developer_manual/prologue/security.rst
+++ b/developer_manual/prologue/security.rst
@@ -229,7 +229,11 @@ To prevent CSRF in an app, be sure to call the following method at the top of al
   <?php
   OCP\JSON::callCheck();
 
-If you are using the App Framework, every controller method is automatically checked for CSRF unless you explicitly exclude it by setting the ``#[NoCSRFRequired]`` attribute or ``@NoCSRFRequired`` annotation before the controller method, see :doc:`../basics/controllers`
+If you are using the App Framework, every controller method is automatically checked for CSRF unless you explicitly exclude it by setting the ``#[NoCSRFRequired]`` attribute or ``@NoCSRFRequired`` annotation before the controller method, see :doc:`../basics/controllers`.
+
+Additionally, it is advised to carefully select the HTTP method used for requests.
+Requests of type ``GET`` should not alter data but just read existing data.
+As long as no other attack is involved, any non-``GET`` request requires at least user interaction (transmitting a form).
 
 Unvalidated redirects
 ---------------------