best-practices-require-form-method | Sheath Rule

#Why

A form with no method submits as GET, putting every field in the URL. That is correct for a search box and wrong for anything that changes data, and the two cases look identical in the template until you check the route.

#Examples

#Bad

<!-- Missing method - defaults to GET -->
<form action="/search">
    <input type="text" name="q">
    <button type="submit">Search</button>
</form>

<!-- Data-modifying form without method -->
<form action="/users">
    <input type="text" name="name">
    <button type="submit">Create User</button>
</form>

<!-- Empty and unsupported HTML methods are not explicit method choices -->
<form method=""></form>
<form method="PUT"></form>

#Good

<!-- Explicit GET for search -->
<form action="/search" method="GET">
    <input type="text" name="q">
    <button type="submit">Search</button>
</form>

<!-- Explicit POST for data modification -->
<form action="/users" method="POST">
    @csrf
    <input type="text" name="name">
    <button type="submit">Create User</button>
</form>

<!-- Native dialog submission closes the containing dialog -->
<dialog>
    <form method="dialog">
        <button type="submit">Close</button>
    </form>
</dialog>

<!-- Livewire prevents the browser's native form submission -->
<form wire:submit="save">
    <button type="submit">Save</button>
</form>

<!-- Alpine does the same when .prevent is explicit -->
<form x-data @submit.prevent="save()">
    <button type="submit">Save</button>
</form>

#Form Methods

Choose a method that matches whether the form reads or changes server state.

Method	Use For
`GET`	Search forms, filtering, navigation - no side effects
`POST`	Creating data, submitting sensitive information
`dialog`	Closing a containing native dialog without a network submission

For PUT, PATCH, DELETE in Laravel, use POST with @method:

<form action="/users/1" method="POST">
    @csrf
    @method('PUT')
    ...
</form>

#References

HTML Spec: Form Method - The method attribute specification
MDN: Form Element - Documentation on form methods

#Notes

Missing method is not reported when form attributes are generated dynamically, such as with {{ $attributes }} or @if
A static method must be GET, POST, or dialog (case-insensitive). A dynamic Blade value such as method="{{ $method }}" is left for runtime.
Missing method is accepted when every render path has durable native-submit interception through wire:submit, x-on:submit.prevent, or @submit.prevent. Livewire adds .prevent itself.
.once, .passive, .outside, and .away listeners do not count because they cannot prevent every native submission. An Alpine listener without .prevent does not count either.

#Related Rules

security-csrf-field - CSRF protection
blade-method-field - Method spoofing