Timeline for Are URL parameters of GET and POST requests over HTTPS secure?
Current License: CC BY-SA 4.0
23 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 29, 2021 at 12:47 | comment | added | usr-local-ΕΨΗΕΛΩΝ |
Note that GET parameters always go to browser history. It's up to user to setup automatic browser history cleanup. Browser might also synchronize history remotely, revealing the parameters to the storage provider
|
|
| Jul 2, 2020 at 6:00 | history | tweeted | twitter.com/StackSecurity/status/1278569100286005253 | ||
| Jun 29, 2020 at 13:38 | comment | added | TheHans255 | @ddyer As Marquis of Lorne said, you appear very concerned about falling back to HTTP. I would recommend you ask a question specifically about you concerns there so we can address them directly. If you find it helpful, I have constructed a draft of the question for you based on your comments: (pastebin.com/WuKuVTRi, expires on 7/13/2020). I do have an answer for you that I would be happy to provide as soon as the question goes up, and it does not involve "maintain your SSL certificates better". | |
| Jun 29, 2020 at 1:56 | comment | added | ddyer | I have a real case of a https GET that was hacked in transit. I'm just trying to tease out the nuances so I can understand what counter measures are available and how effective I can expect them to be. | |
| Jun 29, 2020 at 0:18 | comment | added | user207421 | @ddyer Most of your responses here concern what happens when you mistakenly fall back to HTTP because of problems, real or imagined, with the HTTPS connection or certificate. That's a real or imagined problem but it isn't what you asked here in your question. | |
| Jun 28, 2020 at 11:51 | answer | added | Matthew Steeples | timeline score: 1 | |
| Jun 27, 2020 at 20:37 | answer | added | Boann | timeline score: 4 | |
| Jun 27, 2020 at 10:42 | comment | added | marcelm | @ddyer As far as MitM is concerned, there is no difference between POST body and GET parameters. Both are protected with HTTPS, and unprotected without. There are now 5 answers explaining as much, but you seem hell-bent on arguing. I'm honestly wondering why you even asked this question if you're not going to accept our answer? | |
| Jun 27, 2020 at 1:23 | answer | added | Ángel | timeline score: 35 | |
| Jun 26, 2020 at 21:27 | answer | added | fraxinus | timeline score: 1 | |
| Jun 26, 2020 at 19:38 | comment | added | ddyer | @multithr3at3d I'm concerned about parameters being altered in transit. If I use POST and SSL, that becomes much harder to do, but if MITM can add ?xx=yy parameters to a POST url, and they are not ignored, then the encryption could be moot. | |
| Jun 26, 2020 at 14:55 | answer | added | Pedro | timeline score: 20 | |
| Jun 26, 2020 at 14:53 | history | became hot network question | |||
| S Jun 26, 2020 at 7:20 | history | edited | Anders | CC BY-SA 4.0 |
deleted 2 characters in body; edited tags; edited title
|
| S Jun 26, 2020 at 7:20 | history | suggested | Elie Saad | CC BY-SA 4.0 |
Improved question header
|
| Jun 26, 2020 at 5:51 | comment | added | Elie Saad | The question comes off as if it's documented somewhere. I would heavily recommend on understanding better how HTTP methods work and what TLS does to the HTTP request. Maybe see it in action using wireshark. I am saying this after seeing that @ThoriumBR 's answer covers the question properly (more of how to get a better understanding of what's happening). | |
| Jun 26, 2020 at 5:48 | review | Suggested edits | |||
| S Jun 26, 2020 at 7:20 | |||||
| Jun 26, 2020 at 5:45 | comment | added | user163495 | "It is well-known" - Citation needed! | |
| Jun 26, 2020 at 4:28 | answer | added | mentallurg | timeline score: 7 | |
| Jun 26, 2020 at 1:48 | review | Close votes | |||
| Jul 2, 2020 at 3:01 | |||||
| Jun 26, 2020 at 1:27 | answer | added | ThoriumBR | timeline score: 64 | |
| Jun 26, 2020 at 1:14 | comment | added | multithr3at3d | POST requests are not more secure than GET requests in transit. Why would you want query parameters to be ignored? You may consult the HTTP specs. | |
| Jun 26, 2020 at 0:10 | history | asked | ddyer | CC BY-SA 4.0 |