This question already has an answer here:

Heroku got interesting blog post:

For security reasons, we will be sunsetting support of auth in query string sooner, which we will announce in the Changelog.

However, no explanation is provided about those reasons. So why auth in query string is considered insecure?

marked as duplicate by Sjoerd, Xiong Chiamiov, CaffeineAddiction, Steve, Xander Jun 7 '17 at 20:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


The main reason that I'm aware of is that most http servers will log the query string. If the username/password/security token are sent in the query string, these then get stored in the log file, and you increase the potential for exposure.

  • Do you have an example? – anatoly techtonik Jun 8 '17 at 8:10
  • 1
    Not specifically for Heroku, but I know the W3C Extended Log Format (w3.org/TR/WD-logfile.html) contains the uri-query field. I know IIS logs this by default, and I'd imaging Apache / nginx do the same. – Dan Landberg Jun 8 '17 at 13:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.