9

How safe is a hybrid mobile application developed using a GET Web service over HTTPS?

What are the pros and cons of using it and how safe is POST over HTTPS?

0

2 Answers 2

13

In HTTPS, the TLS channel is established before and HTTP data is transfered so, from that point of view, there is no difference between GET and POST requests (or any other HTTP verb, for that matter).

A few things might impact system security, though:

  • GET requests usually are logged in full while POST requests usually are not. This means that, potentially, you might get more information leaked through GET than POSTS (this logging can happen in the client - through history - on a proxy server or on the web server itself).
  • GET requests are more constrained by size than POSTs. This makes it (slightly) more difficult to use them as a way to attack the web application.
4
  • Is there any white papaper regarding this?
    – user47784
    Jun 4, 2014 at 12:16
  • 2
    regarding what ?
    – Stephane
    Jun 4, 2014 at 12:55
  • 2
    Also, According to RFC 2616, GET requests should be idempotent; see Using GET for a non-idempotent request on StackOverflow, for example. Jun 4, 2014 at 15:33
  • I believe @OwenBlacker should be considered as a main point. NEVER use GET if it changes anything in the system (other than statistics of course). I personally don't make an exception even if I have CSRF tokens.
    – AKS
    Jun 4, 2014 at 17:55
2

If you have sensitive information you should not use a GET even with https, because these information might be sent to a 3rd party inside the Referer.

1
  • This applies when you use it as a page URL, but not when using it in an AJAX request. Jun 4, 2014 at 12:20

Not the answer you're looking for? Browse other questions tagged .