Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

How safe is a hybrid mobile application developed using a GET Web service over HTTPS?

What are the pros and cons of using it and how safe is POST over HTTPS?

share|improve this question

marked as duplicate by TildalWave, Xander, D.W., AJ Henderson, Adnan Jun 4 at 17:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

up vote 9 down vote accepted

In HTTPS, the TLS channel is established before and HTTP data is transfered so, from that point of view, there is no difference between GET and POST requests (or any other HTTP verb, for that matter).

A few things might impact system security, though:

  • GET requests usually are logged in full while POST requests usually are not. This means that, potentially, you might get more information leaked through GET than POSTS (this logging can happen in the client - through history - on a proxy server or on the web server itself).
  • GET requests are more constrained by size than POSTs. This makes it (slightly) more difficult to use them as a way to attack the web application.
share|improve this answer
    
Is there any white papaper regarding this? –  user47784 Jun 4 at 12:16
2  
regarding what ? –  Stephane Jun 4 at 12:55
1  
Also, According to RFC 2616, GET requests should be idempotent; see Using GET for a non-idempotent request on StackOverflow, for example. –  Owen Blacker Jun 4 at 15:33
    
I believe @OwenBlacker should be considered as a main point. NEVER use GET if it changes anything in the system (other than statistics of course). I personally don't make an exception even if I have CSRF tokens. –  Ayesh K Jun 4 at 17:55

If you have sensitive information you should not use a GET even with https, because these information might be sent to a 3rd party inside the Referer.

share|improve this answer
    
This applies when you use it as a page URL, but not when using it in an AJAX request. –  user2428118 Jun 4 at 12:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.