-1

Use case:

  1. User logs into the site.
  2. User goes to the "change password" page

On the "change password" page, I noticed that the username is being displayed in the URL:

https://example.com/cp.aspx?un=myusername

Is it possible for the username to not to be seen in the URL?

Improve this question
3
  • Off topic: I suggest to test and see if you are able to change a password for another user in the system by modifying the parameter "un"
    – Jeroen
    Apr 10, 2018 at 4:22
  • Off topic. This has nothing to do with scope of this forum. Rather than providing one line answers, people should forward it to appropriate forums.
    – tech_enthusiast
    Apr 10, 2018 at 4:33
  • thank you guys for looking into my question. i am new to programming and I was asked to address some infosec related concerns such as this one. will look into your answers - thanks again!
    – iamkupao23
    Apr 10, 2018 at 5:20

3 Answers 3

Reset to default
0

Yes, it is always possible, This is a matter of programming. You have used GET instead of POST. Use POST to send data without query strings which can be seen by the user. To secure it more, you could use HTTPS or encrypt the username with a public key and then send via POST, then decrypt it by using the private key from the server controller. See more : GET and POST

Improve this answer
0
1

Username can be sent in HTTP body by using POST request.

Improve this answer
0
1

Yes, since you're already logged in, the site could infer the username from your session cookie.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .