Typically, mutations should be executed using the POST method, as GET requests are intended for fetching data without side effects. Allowing mutations over GET can lead to several security risks
An attacker sends a GET request with a mutation query embedded in the URL, such as deleting a user or updating account details. If the server allows mutations via GET, the attacker can execute this mutation without the need for additional authentication or protection, potentially leading to unauthorized data modification.
