I've been building web apps for awhile, and while I'm quite aware that this is the Internet and your server has to be ready for anything, by and large humans using browsers make the HTTP requests you expect them to make.I find it hard to explain, then, why particular unsanctioned calls show up again and again. For instance, I have one endpoint, /api/organizations/<id> which accepts GET requests, but not POST requests. Yet certain clients will commonly POST to that endpoint. Why might that be the case?I want to understand my users better and make sure I'm not making any important mistakes. I've reviewed my client side code and I'm fairly certain it's not my javascript making the request.--EDIT--To be clear, this is not a reproducible error. Trying to use the app with a browser with a matching user agent does NOT make the unsanctioned call. The pattern suggests a very small set of individuals generating the calls with some idiosyncratic local setup.
Why clients might send unsanctioned requests (i.e. where did this POST come from?)
browsers;api