What is the reason?

runarberg · on March 12, 2022

I don’t know what OP thinks is the reason, but the actual reason is CORS.

Web Devs (such as me) have asked for e.g. DELETE as an acceptable formmethod (e.g. https://github.com/whatwg/html/issues/3577) however WHATWG always pushes back citing security concerns such as CORS.

I suspect this is not what OP had in mind since it is trivial to send a DELETE request with a simple JavaScript:

    <button onclick="fetch('/api/resource/42', { method: 'DELETE' })">
      Delete
    </button>

egberts1 · on March 12, 2022

Right.

If CORS can be weakened in any simple way with that HTRP-DELETE method, then your database could simply disappeared via HTTP-DELETE method.

Besides, webmasters’ HTTP DELETE method is a different domain scoping issue than the web developers’ HTML/JavaScript FORM deleteThis row-entry approach.

I marvel at designers trying to flatten the scoping/nesting of abstractions without factoring apart the disparate error and protocol handling.