Imagine button after clicking which browser sends XHR http request with GET method. Characteristics:
- after executing request sensitive action is performed
- sensitive information is sent in GET parameters
- HTTP headers
X-CSRF-Tokenwith large enough PRG token are sent and are necessary to have the action executed
- option to
Copy link locationisn't accessible when rightclick the button as it's a form
Normally XHR is used with GET but here it's used with GET. It's the only difference from normal XHR requests.
Does this design lead to any security vulnerability?
Edit: Some answerers and commenters tell that:
- User may copy or bookmark url. However, the only place from where user may copy url is the source code of page because this url isn't exposed in browser address bar, rightclick menu because of button is a form). Also parameters are added into request by browser itself so user can't copy full url from source code.
- User may copy part of browser window. However, url isn't exposed in browser window
- It may become part of Referer header. However, it's XHR and doesn't change url in Referer header of next requests
So the only valid vulnerability seems to be that GET parameters may be logged in webserver logs (they won't be logged at proxy because of using TLS). If those logs are accessible to attacker, then he will have sensitive information.