One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the violations, based on OWASP's #3 risk, is that sensitive data is present in browser history. This can be both in the query strings (as in "myurl.com/somepage?userid=user123") or in the url segments themselves (as in "myurl.com/users/user123/edit").
The idea is that an adversary with access to the victim's system will be able to gain access to sensitive data just by viewing the browser history and seeing the data in the urls.
Question:
What are ways to solve this? For query string parameters, I know you can simply change the form method from GET to POST - are there any other ways to handle the query string parameters? What about handling data in the url segments?