title: Why shouldn't we allow body in a GET or HEAD request?
body: <p>I'm coming to this from the InfoSec side, not the AppDev side, I just wanted to put that caveat in first. The issue is that my WAF is blocking certain images with the response, <em>HTTP protocol compliance failed:Body in GET or HEAD requests</em>. I need to justify keeping this rule active, so I'm asking, as a non-developer:</p>
  
  <ol>
  <li>is this getting blocked because that's the rules of GET and HEAD requests, or can we allow Body in GET and HEAD requests, but it's really not a good idea ?</li>
  <li>Why is it not a good idea? What are the potential problems that arise from allowing Body in a GET or HEAD request?</li>
  </ol>
  
  <p>Thanks in advance for everyone's help. </p>