My problem is similar with this: CQ5: 403 Forbidden occurs when call a Post servlet but in AEM 6.1
According to accepted answer of above topic, I must remove POST from A
The POST call is needed for the modification of the content. There will be no harm untill unless your instances are not protected by some more request handle mechanism infront of AEM by dispatcher and Akamai servers, where you can do a request filter at dispatcher and before that even at akamai level and allow only the exact post requests for a application specific.
Dispatch filter example:
which shows to allow only the post call with a @SlingServlet(paths = "/bin/sling/myproj/exampleauthhandler")
/filter {
/0001 { /glob "*" /type "deny" }
/0999 { /type "allow" /method "POST" /url "/bin/sling/myproj/exampleauthhandler" }
}
More information you can find for AEM dispatcher
https://docs.adobe.com/docs/en/dispatcher/disp-config.html
we have also methods called PUT and PATCH which is also worthy but not best suited for the real time scenarios.
PATCH :: https://tools.ietf.org/html/rfc5789
also an good discussion you can find PUT vs PATCH
REST API - PUT vs PATCH with real life examples