I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in a get request to the authentication end point. This all happens over ssl.
Initially I thought this was insecure, but this post seems to suggest it's not insecure at the transport layer SSL with GET and POST. The only concern is how the request is logged by the server. Given I'm writing the server side and can control logging, is this something I should worry about. Should I insist the app team change the client to send a post request to better secure the password, or is that unecessary?