Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL:

Could a malicious person intercept the request and read the 'supersecret' argument?

share|improve this question
up vote 7 down vote accepted

The same question had come up in stackoverflow some time back,please find the link below.

To summarize the answers mentioned in the link, the url parameters that are sent to the server will be encrypted and hence is not vulnerable to interception, however if you are referring any 3rd party from your page (eg:jquery) then unless the reference is via ssl, the entire url will be present as clear text in the http referrer field and that can be intercepted and read.

Possibly the urls can be logged as plaintext on the server, in the browser history and maybe there are browser plugins that cache the url.Hence it is not a good practice

It is better to send sensitive parameters using POST.

Additionally i have confirmed by running wireshark while accessing the URL had a lot of parameters and everything was encrypted by ssl.

share|improve this answer
Regarding the referer header, see RFC 2616, section 15.1.3: "Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol." – Jumbogram Apr 29 '13 at 13:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.