CODEWITHSUNDEEP
phppostcurlget
ProDraz
ProDraz

Reputation: 1281

Are GET / POST params encrypted?

How safe is it to pass passwords / username in POST or GET requests to an external server?

I will use PHP / CURL and I have second toughts about security.

Alternatives will be considered aswell!

Upvotes: 0

Views: 1981

Answers (2)

Noah T
Noah T

Reputation: 235

By themselves, not necessarily. You shouldn't use GET for things aside from queries, in general because they can get stored on the user's browser. POST is relatively easy to encrypt using libraries, as you shouldn't implement your own encryption.

Also, if you get an SSL, that would help. If you use HTTPS (rather than HTTP), then it will be even more secure.

You didn't give many details as to what the page was (read: the language) so I can't really recommend a good encryption library, but just Google it and I'm sure you'll find something.

Upvotes: 0

Josh Lee
Josh Lee

Reputation: 177855

If you use HTTP without SSL encryption, everything is transmitted in the clear, which includes the full URL, the HTTP request/response headers, and the body of the POST request and response.

If you place a password in the GET parameters, it will additionally be displayed in the address bar and quite likely saved in browser history, proxy server logs, and sent to other websites in the referrer header. Sending the password in the POST body or in the standard Authorization header avoids this obvious problem, but it is still visible to an observer who can sniff or proxy your traffic.

Digest Authentication avoids transmitting the password in the clear, and only a non-reusable signature is exposed to the outside observer. It is still vulnerable to man-in-the-middle attacks; see HTTP Digest Authentication versus SSL.

The correct solution is to use an SSL certificate and exclusively use HTTPS. When you do so, the URL string, HTTP headers, and POST body are all encrypted, and the browser verifies that no third party is operating a server in the middle. HTTP Basic Authentication is permissible in this case.

Upvotes: 9

Related Questions