405 response when the request should be POST

#13397

CHANGELOG-WIP.md

@@ -10,6 +10,7 @@
 - Added support for defining custom locale aliases, via a new `localeAliases` config setting. ([#12705](https://github.com/craftcms/cms/pull/12705))
 
 ### Development
+- Controller actions which require a `POST` request will now respond with a 405 error code if another request method is used. ([#13397](https://github.com/craftcms/cms/discussions/13397)) 
 
 ### Extensibility
 - The control panel now defines new CSS variables for orange, green, and violet colors. Existing color palette CSS variables have been updated to match the Tailwind 3 color palette.

src/web/Controller.php

@@ -17,6 +17,7 @@
 use yii\web\BadRequestHttpException;
 use yii\web\ForbiddenHttpException;
 use yii\web\JsonResponseFormatter;
+use yii\web\MethodNotAllowedHttpException;
 use yii\web\Response as YiiResponse;
 use yii\web\UnauthorizedHttpException;
 
@@ -457,12 +458,12 @@ public function requireElevatedSession(): void
     /**
      * Throws a 400 error if this isn’t a POST request
      *
-     * @throws BadRequestHttpException if the request is not a post request
+     * @throws MethodNotAllowedHttpException if the request is not a POST request
      */
     public function requirePostRequest(): void
     {
         if (!$this->request->getIsPost()) {
-            throw new BadRequestHttpException('Post request required');
+            throw new MethodNotAllowedHttpException('Post request required');
         }
     }