Is CSRF possible with PUT or DELETE methods?

Great question! In a perfect world, I can't think of a way to perform a CSRF attack. You cannot make PUT or DELETE requests using HTML forms. Images, Script tags, CSS Links etc all send GET requests to the server. XmlHttpRequest and browser plugins such as Flash/Silverlight/Applets will block cross-domain requests. So, in general, it shouldn't be possible to make a CSRF attack to a resource that s