CODEWITHSUNDEEP
sslhttpsquery-stringhttp-get
Shiraz Bhaiji
Shiraz Bhaiji

Reputation: 65391

Sending sensitive data as a query string parameter

We are reviewing the design of a system. And need to verify what we think may be a security issue.

In this system some sensitive information is sent in the query string. Question is:

Upvotes: 4

Views: 3568

Answers (3)

Jatin
Jatin

Reputation: 1

This is certainly a security issue if sensitive details are being passed in get request. Sensitive data will not only get cached in the user's browser but also in any proxy on d way and plus in webserver logs

Upvotes: 0

Bruno
Bruno

Reputation: 122649

When you use HTTPS, the SSL/TLS connection is established before any HTTP traffic is sent, thus the whole request (including the URL and its parameters) will be encrypted and won't be readable. The only thing that's possibly visible by a third party is the server certificate (so they could see the host name, but that's it).

The browser's history isn't protected in any way by HTTPS as such, although some browsers may have some "safe browsing" options which would delete some HTTPS URLs automatically perhaps. This one ultimately really depends on the browser and its configuration.

Upvotes: 10

Raghuram
Raghuram

Reputation: 52645

Yes for the first. Not sure about the second - depends on the browser, I guess - but I suspect, Yes, here as well.

Upvotes: -1

Related Questions