For an API, I know that passing tokens in the url has the following security implications:

  1. They get saved in browser history
  2. They’re probably saved in your server’s logs and memory
  3. Users might post the link, not realizing what they’ve shared
  4. This information will be exposed in the “referrer” header.
  5. They’re available to browser extensions.

I found a SE answer saying that these are not a concern when it comes to the case of a websockets. I understand that browser won't cache the websocket urls in history or anywhere else since it is not explicitly passed via the address bar.In that way, browser extensions also doesn't get access to them as long as we explicitly allow the access for extensions. The chances of third point is also comparatively less.

The only thing I am concerned is the logging of websocket urls in server logs and caches. Isn't it actually applicable? Do servers such as Nginx and Apache log the websocket requests?

Is my assumptions correct for points other than this?

1 Answer 1


When Websockets layer on top of TCP and handshakes are being maintained by HTTP before switching using 101 response, it is not safe to allow tokens in the URL parameters since it gets logged in the server just like how an HTTP request would do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .