The whole point of HTTPS is to encrypt all traffic, including the request line. Do when you do a request like:<p><pre><code>  GET &#x2F;customer&#x2F;orders&#x2F;?id=2348&amp;order_id=3456 HTTP&#x2F;1.1
  Host: example.com
</code></pre>
over HTTPS, the first line also gets encrypted. So no point in banning GET.