I have inherited an ASP website where sensitive data was passed in the query string as part of the URL. Something like this:
If we change this to encrypt the query string, so
moreDetails are not visible, I assume I still have the issue that this encrypted URL is stored in the browser's history, so it doesn't really handle the issue, does it? Am I correct that
no-cache won't help either as although that may prevent it from being cached, I assume the URL will still be in the browser's history. Any way to prevent this?
I suppose the best solution is to use a
POST and send the sensitive data in the body? But that's a bit of work.