Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL:

https://www.myserver.com/secure/somePHPFile.php?supersecret=bananas

Could a malicious person intercept the request and read the 'supersecret' argument?

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

The same question had come up in stackoverflow some time back,please find the link below.

http://stackoverflow.com/questions/893959/if-you-use-https-will-your-url-params-will-be-safe-from-sniffing

To summarize the answers mentioned in the link, the url parameters that are sent to the server will be encrypted and hence is not vulnerable to interception, however if you are referring any 3rd party from your page (eg:jquery) then unless the reference is via ssl, the entire url will be present as clear text in the http referrer field and that can be intercepted and read.

Possibly the urls can be logged as plaintext on the server, in the browser history and maybe there are browser plugins that cache the url.Hence it is not a good practice

It is better to send sensitive parameters using POST.

Additionally i have confirmed by running wireshark while accessing https://google.com. the URL had a lot of parameters and everything was encrypted by ssl.

share|improve this answer
    
Regarding the referer header, see RFC 2616, section 15.1.3: "Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol." –  Jumbogram Apr 29 '13 at 13:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.