Imagine you work at a bank with two windows: one for deposits (requires ID, signed form, the works) and one for balance inquiries (just walk up and ask). Now imagine the deposit window secretly processes requests from anyone who walks up to the inquiry window with the right account number scrawled on a napkin. That is HTTP method interchangeability — and this paper is the first large-scale audit of how often real websites leave the deposit window unlocked. The committed claim: POST-to-GET interchangeability is not a theoretical curiosity but a measurable, widespread phenomenon on the live web. The authors built MIDE (Method Interchange Detection Engine), a crawl-replay pipeline that visits the Tranco top 10,000 sites, records every POST request triggered by page loads and UI interactions, rewrites each POST body into a GET query string, replays it, and compares responses. Crucially, they also fire a no-query GET baseline to filter out endpoints that return the same page regardless of parameters. Only when the converted GET matches the POST and the baseline does not do they call it high-confidence interchangeability. The numbers are sobering but bounded. Of 10,000 sites crawled, 3,200 generated at least one POST, 2,734 had POSTs that could be replayed, and 407 (14.9% of that pool, 4.1% of the full 10K) showed high-confidence method interchange. The paper goes further: a targeted CSRF token-replay check finds cases where an invalid token is rejected on POST but silently accepted on the equivalent GET — meaning the CSRF defense is method-scoped and the GET rewrite bypasses it entirely. They also observe Web Cache Deception (WCD) conditions where the interchangeable GET variant is cacheable, potentially leaking user-specific responses to shared caches. Architecturally, MIDE is a browser-instrumented crawl-replay pipeline — not a static analyzer or a fuzzer. It drives a real browser, captures real POST traffic from rendered pages, performs mechanical URL rewriting, and uses response-similarity comparison (likely structural or content hashing, though the abstract doesn't specify the similarity metric). The key engineering choice is the baseline control: by comparing the rewritten GET against both the original POST and a parameter-free GET, they avoid inflating their count with endpoints that serve the same generic page to everything. The integrity posture is solid for a measurement study. The Tranco top 10K is a well-established community benchmark for web measurement research, the experiment is unauthenticated (conservative — authenticated crawls would likely find more interchangeability), and the three-way comparison design (POST vs converted GET vs baseline GET) is a genuine methodological contribution that reduces false positives. The limitation is that this is exclusively the authors' own tooling on one snapshot — no independent replication exists yet, and the crawl captures only unauthenticated traffic, which means the authenticated attack surface (where CSRF and WCD matter most) remains unmeasured. The field argument this paper enters is practical: should web frameworks enforce HTTP method semantics by default, or is it the developer's job? Most frameworks (Django, Rails, Express) provide method-routing decorators, but many legacy and CMS-driven sites treat method semantics as advisory. This paper provides the first empirical ammunition for the "enforce by default" camp — 14.9% is not a rounding error. The obvious successor experiment the authors did not run is authenticated crawling. Logging in, performing state-changing operations behind session cookies, and testing whether POST-to-GET rewriting preserves session-bound behavior would dramatically raise the stakes. The honest read: this is almost certainly (a) scope management for a single conference paper plus (b) ethical constraints — you cannot casually replay authenticated state-changing requests on production sites you don't own. Expect the authenticated version on controlled testbeds in a follow-up.
