I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL:


Could a malicious person intercept the request and read the 'supersecret' argument?

1 Answer 1


The same question had come up in stackoverflow some time back,please find the link below.


To summarize the answers mentioned in the link, the url parameters that are sent to the server will be encrypted and hence is not vulnerable to interception, however if you are referring any 3rd party from your page (eg:jquery) then unless the reference is via ssl, the entire url will be present as clear text in the http referrer field and that can be intercepted and read.

Possibly the urls can be logged as plaintext on the server, in the browser history and maybe there are browser plugins that cache the url.Hence it is not a good practice

It is better to send sensitive parameters using POST.

Additionally i have confirmed by running wireshark while accessing https://google.com. the URL had a lot of parameters and everything was encrypted by ssl.

  • Regarding the referer header, see RFC 2616, section 15.1.3: "Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol."
    – Jumbogram
    Apr 29, 2013 at 13:54

You must log in to answer this question.