I've recently encountered a webapp, which has it's url in the following format:
http://www.[WEBAPP].com/INetService/Show.aspx?Username=[EMAIL]&EncryptedPassword=[Some String of 32 characters length]
Now this seems like a pretty bad way of delivering the login credentials to the server especially since not only is it using http, so an attacker could easily read the traffic, but also you can copy paste this link after any duration of time into another browser on another computer and it will work.
This effectively means that if the users browser history is somehow compromised (for example by carelessly using a public computer), the users account can be compromised aswell, and logging out is essentially doing nothing.
How should I proceed, should I notify the developer of the application?