Heroku got interesting blog post:

For security reasons, we will be sunsetting support of auth in query string sooner, which we will announce in the Changelog.

However, no explanation is provided about those reasons. So why auth in query string is considered insecure?


1 Answer 1


The main reason that I'm aware of is that most http servers will log the query string. If the username/password/security token are sent in the query string, these then get stored in the log file, and you increase the potential for exposure.

  • Do you have an example? Jun 8, 2017 at 8:10
  • 1
    Not specifically for Heroku, but I know the W3C Extended Log Format (w3.org/TR/WD-logfile.html) contains the uri-query field. I know IIS logs this by default, and I'd imaging Apache / nginx do the same. Jun 8, 2017 at 13:52

Not the answer you're looking for? Browse other questions tagged .