HUMAN VERIFICATION REQUIREDASVS 4.1.4 HTTP-method allowlist
MB-C18ASVS Level 3 Human AssuranceHigh
Only HTTP methods that are explicitly supported by the application or its API (including OPTIONS during preflight requests) can be used and that unused methods are blocked.