13.6.2 move into V50 (if not merged into V50.4.1)

[elarlang]

Current requirement 13.6.2:

#	Description	L1	L2	L3	CWE
13.6.2	[MODIFIED, MOVED FROM 13.2.1] Verify that HTTP requests using the HEAD, OPTIONS, TRACE or GET verb do not modify any backend data structure or perform any state-changing actions. These requests are safe methods and should therefore not have any side effects.	✓	✓	✓	650

I think this is browser-based attack scenario specific and a pre-condition to have defense against (so-callsd) CSRF attacks in place.

The option is to merge into to the "csrf" requirement or move to the same section.

Related comment and issue: #2481 (comment)

[tghosth]

So the question is, is CSRF the only security risk which this requirement addresses?

In principle, there is a general assumption that HEAD, OPTIONS, TRACE or GET verb do not modify any backend data structure or perform any state-changing actions. However, I am not sure there is a specific security risk outside of CSRF.

This requirement seems to have been added as a result of the discussion in #672 which included people such as @Sjord, @VincentDS, and @Someniak.

Based on that discussion I think the only risk is CSRF and therefore I propose that this should be merged into the CSRF requirement (currently being worked on in #2481).

I am open to other points of view though.