For an API, I know that passing tokens in the url has the following security implications:
- They get saved in browser history
- They’re probably saved in your server’s logs and memory
- Users might post the link, not realizing what they’ve shared
- This information will be exposed in the “referrer” header.
- They’re available to browser extensions.
I found a SE answer saying that these are not a concern when it comes to the case of a websockets. I understand that browser won't cache the websocket urls in history or anywhere else since it is not explicitly passed via the address bar.In that way, browser extensions also doesn't get access to them as long as we explicitly allow the access for extensions. The chances of third point is also comparatively less.
The only thing I am concerned is the logging of websocket urls in server logs and caches. Isn't it actually applicable? Do servers such as Nginx and Apache log the websocket requests?
Is my assumptions correct for points other than this?