Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and response.

I ask because an api requires me to pass user data over https(their user's data ofc). The username and password are passed as http AUTH:

share|improve this question

marked as duplicate by rook, Adi, LamonteCristo, Lucas Kauffman, NULLZ Jul 10 '13 at 5:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 6 down vote accepted

HTTPS uses Transport Layer Security (TLS). The Transport layer is layer 4, so everything above this layer is encrypted, which means all of HTTP is encrypted.

By default on most HTTP servers, all GET parameters are logged to the access log. The plaintext logging of authentication tokens is a vulnerability. The Authentication HTTP header is not logged by default.

share|improve this answer
This answer claims that the receiving server can store the urls in the log. It is unclear to me if they are stored encrypted or in cleartext. But even if they were encrypted this would still offer another vector of attack. Could you clarify or expand your answer? You may take a look at my question which is my attempt to get a canonical answer on this topic. – threeFourOneSixOneThree Nov 3 '14 at 10:06
@threeFourOneSixOneThree OP never stated the webserver used, updated for the general case. – rook Nov 3 '14 at 15:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.