Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/1278569100286005253
Became Hot Network Question
deleted 2 characters in body; edited tags; edited title
Source Link
Anders
Anders
  • 65.8k
  • 25
  • 185
  • 226

HTTP Are URL parameters of GET Method Weaknessand POST requests over HTTPS secure?

It's well known that GET requests with ?xx=yy?xx=yy arguments embedded can be altered in transit, and therefore are insecure.

If I change the request to POST, and use HTTPS, then the parameters are in the body of the message, which is encrypted, and therefore difficult to hack, correct?

Two more cases concern me. Suppose GET style parameters were added to a POST request - would those parameters be reliably ignored?

What about some sort of security downgrade attack? If the URL manipulator forces HTTPS transactions to fail, and then the client/server "helpfully" downgrade to HTTP, which would allow the unencrypted POST body to be manipulated.

HTTP GET Method Weakness

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure.

If I change the request to POST, and use HTTPS, then the parameters are in the body of the message, which is encrypted, and therefore difficult to hack, correct?

Two more cases concern me. Suppose GET style parameters were added to a POST request - would those parameters be reliably ignored?

What about some sort of security downgrade attack? If the URL manipulator forces HTTPS transactions to fail, and then the client/server "helpfully" downgrade to HTTP, which would allow the unencrypted POST body to be manipulated.

Are URL parameters of GET and POST requests over HTTPS secure?

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure.

If I change the request to POST, and use HTTPS, then the parameters are in the body of the message, which is encrypted, and therefore difficult to hack, correct?

Two more cases concern me. Suppose GET style parameters were added to a POST request - would those parameters be reliably ignored?

What about some sort of security downgrade attack? If the URL manipulator forces HTTPS transactions to fail, and then the client/server "helpfully" downgrade to HTTP, which would allow the unencrypted POST body to be manipulated.

Improved question header
Link
edit approved Jun 26, 2020 at 7:20
Elie Saad
edit approved Jun 26, 2020 at 7:20
Elie Saad
  • 427
  • 2
  • 4
  • 14

vulnerability of http HTTP GET Method Weakness

Source Link
ddyer
ddyer
  • 2k
  • 1
  • 13
  • 20

vulnerability of http GET

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure.

If I change the request to POST, and use HTTPS, then the parameters are in the body of the message, which is encrypted, and therefore difficult to hack, correct?

Two more cases concern me. Suppose GET style parameters were added to a POST request - would those parameters be reliably ignored?

What about some sort of security downgrade attack? If the URL manipulator forces HTTPS transactions to fail, and then the client/server "helpfully" downgrade to HTTP, which would allow the unencrypted POST body to be manipulated.