Wstg: Deduplicate sections 4.2.6 Test HTTP Methods and 4.7.3 Testing for HTTP Verb Tampering

[johanna-a]

What's the issue?
The sections 4.2.6 Test HTTP Methods and 4.7.3 Testing for HTTP Verb Tampering are very similar in subject. They both for example list the allowed HTTP methods in HTTP 1.1. They both refer Arshan Dabirsiaghi's work, although one only with a link in the References section and the other with a mention of Arshans work in the text with a reference to a link that does not exist. These are some examples, I believe there are more places in which they overlap.

How do we solve it?
While both sections would benefit from a review I think that it's worth having the discussion first about whether to keep them and if so how to separate them content-wise so that both sections add value.
Right now I think that the best way forward may be either of:
a) Moving all of the content to section 4.7.3 Testing for HTTP Verb Tampering, perhaps changing it's title
b) Reworking 4.2.6 Test HTTP Methods to cover only "Information Gathering" - meaning identification of HTTP Methods that the web server is advertising as supported (i.e. using OPTIONS for discovery) and moving all other content to 4.7.3 Testing for HTTP Verb Tampering. This may involve moving section 4.2.6 Test HTTP Methods to the 4.1 Information Gathering section rather than having it in 4.2

These are my ideas at the moment, I'd love to have a discussion that changes or refines them :)

Would you like to be assigned to this issue?
Check the box if you will submit a PR to fix this issue. Please read CONTRIBUTING.md.

• [x] Assign me, please!
  (As in, after we've had a discussion, I'd like a stab at making whatever change is decided)

[ThunderSon]

I believe this fits more into the configuration of the server, more than input validation.
This is set based on what the server requires to allow external parties to interact with, and moreover, this belongs to the HTTP protocol, which should be configured.

This whole chapter (Chapter 4.2) could be revised and better tackled to contain the newer headers (CORS, CSP, etc.). Thanks for pointing this issue out.
@kingthorin what do you think about this?

[kingthorin]

Ya I think it makes sense to consolidate the content under 4.2.6, I agree that it isn't really an input validation item.

[github-actions[bot]]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[johanna-a]

This is (hopefully) about to be implemented with PR #480 which turned into #502