CODEWITHSUNDEEP
sslhttps
vee
vee

Reputation: 739

with https are GET requests less secure than Post Requests

As the title says. Should you pass an authentication token in the url of a GET request? What about man-in-the-middle attacks? Or Packet sniffing? All including the requests being wrapped with HTTPS

Upvotes: 0

Views: 39

Answers (1)

thopaw
thopaw

Reputation: 4044

When you use https GET and POST are equally secure for man-in-the-middle attacks as the payload is encrypted and nobody except the receiver with the private key can see the data.

Using GET the urls visited are stored in the browser history and can also be shared (accidentally) with other pople (see also Session Hijacking). So I would not pass auth information as query parameter but use http header cookies or something wich is not stored in the browsers history. If you have to do it you should be sure that the auth information invalidated after some time.

Upvotes: 1

Related Questions