When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, because it was in my browser's history. Seeing my password in plain text there made me feel very uncomfortable. Of course, this will never happen in the XHR request, which is the only way the api url is accessed.

But still, it got me thinking. First I did my research on if it is right to send sensible data in plain text and if I shouldn't encrypt or at least base64 encode it, but it's said it is normal to send data in plain text when you're using HTTPS (which of course I do on my website!).

Then I was like: fine, then let me just swap to a POST request instead. This feels better for me than seeing the data in the URL. But this would interfere with the idea of RESTful APIs. It should be a GET request.

So what can I do? What should I do? Or what you just do nothing? I'm curious.

2 Answers 2


What do you use username and password for? If you are using them for logging in/authorization then usually:

  1. You would have an end point like /login and you pass your username and password 1 time using POST method,
  2. Then depending on the authentication system you are using, the end point returns a token or session information,
  3. You pass this token or session information inside the header part of your subsequent requests. So you don't have to pass your username/password every time you make a request to your API.

It is ok to pass your username and password as plain text on first POST request when you are using HTTPS, but don't put them in your URL.


Sending credentials in the URL is definitely against best practices. It exposes secrets: browsers remember them, proxies log them, the server logs them. Just don’t do it.

As for what you should do, it depends on your use-case. If you are managing sessions have a login endpoint which starts the session and then use the session for authentication. You mentioned XHR, so this is probably the way to go. About how to manage session, and what trade-offs you can expect, I recommend reading this article I wrote a while back.

If you are looking for alternative authentication methods. Check out my Web API Authentication Guide.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .