Is an HTTPS query string secure

Question

I am creating a secure web based API that uses HTTPS  however  if I allow the users to configure it  include sending password  using a query string will this also be secure or should I force it to be done via a POST

User · Answer

Yes  as long as no one is looking over your shoulder at the monitor

User · Answer

I don t agree with the statement about       HTTP referrer leakage  an external image in the target page might leak the password  in Slough s response   The HTTP 1 1 RFC explicitly states      Clients SHOULD NOT include a Referer   header field in a  non-secure  HTTP   request if the referring page was   transferred with a secure protocol    Anyway  server logs and browser history are more than sufficient reasons not to put sensitive data in the query string

User · Answer

Yes  from the moment on you establish a HTTPS connection everyting is secure  The query string  GET  as the POST is sent over SSL

User · Answer

Yes  The entire text of an HTTPS session is secured by SSL  That includes the query and the headers  In that respect  a POST and a GET would be exactly the same   As to the security of your method  there s no real way to say without proper inspection

User · Answer

SSL first connects to the host  so the host name and port number are transferred as clear text  When the host responds and the challenge succeeds  the client will encrypt the HTTP request with the actual URL  i e  anything after the third slash  and and send it to the server   There are several ways to break this security   It is possible to configure a proxy to act as a  man in the middle   Basically  the browser sends the request to connect to the real server to the proxy  If the proxy is configured this way  it will connect via SSL to the real server but the browser will still talk to the proxy  So if an attacker can gain access of the proxy  he can see all the data that flows through it in clear text   Your requests will also be visible in the browser history  Users might be tempted to bookmark the site  Some users have bookmark sync tools installed  so the password could end up on deli ci us or some other place   Lastly  someone might have hacked your computer and installed a keyboard logger or a screen scraper  and a lot of Trojan Horse type viruses do   Since the password is visible directly on the screen  as opposed to     in a password dialog   this is another security hole   Conclusion  When it comes to security  always rely on the beaten path  There is just too much that you don t know  won t think of and which will break your neck

User · Answer

Yes  it is  But using GET for sensitive data is a bad idea for several reasons    Mostly HTTP referrer leakage  an external image in the target page might leak the password 1   Password will be stored in server logs  which is obviously bad  History caches in browsers    Therefore  even though Querystring is secured it s not recommended to transfer sensitive data over querystring    1  Although I need to note that RFC states that browser should not send referrers from HTTPS  to HTTP  But that doesn t mean a bad 3rd party browser toolbar or an external image flash from an HTTPS site won t leak it

User · Answer

Yes  it is  But using GET for sensitive data is a bad idea for several reasons    Mostly HTTP referrer leakage  an external image in the target page might leak the password 1   Password will be stored in server logs  which is obviously bad  History caches in browsers    Therefore  even though Querystring is secured it s not recommended to transfer sensitive data over querystring    1  Although I need to note that RFC states that browser should not send referrers from HTTPS  to HTTP  But that doesn t mean a bad 3rd party browser toolbar or an external image flash from an HTTPS site won t leak it

User · Answer

From a  sniff the network packet  point of view a GET request is safe  as the browser will first establish the secure connection and then send the request containing the GET parameters  But GET url s will be stored in the users browser history   autocomplete  which is not a good place to store e g  password data in  Of course this only applies if you take the broader  Webservice  definition that might access the service from a browser  if you access it only from your custom application this should not be a problem   So using post at least for password dialogs should be preferred  Also as pointed out in the link littlegeek posted a GET URL is more likely to be written to your server logs

User · Answer

I don t agree with the statement about       HTTP referrer leakage  an external image in the target page might leak the password  in Slough s response   The HTTP 1 1 RFC explicitly states      Clients SHOULD NOT include a Referer   header field in a  non-secure  HTTP   request if the referring page was   transferred with a secure protocol    Anyway  server logs and browser history are more than sufficient reasons not to put sensitive data in the query string

User · Answer

Yes  from the moment on you establish a HTTPS connection everyting is secure  The query string  GET  as the POST is sent over SSL

User · Answer

Yes  The entire text of an HTTPS session is secured by SSL  That includes the query and the headers  In that respect  a POST and a GET would be exactly the same   As to the security of your method  there s no real way to say without proper inspection

User · Answer

Yes  it is  But using GET for sensitive data is a bad idea for several reasons    Mostly HTTP referrer leakage  an external image in the target page might leak the password 1   Password will be stored in server logs  which is obviously bad  History caches in browsers    Therefore  even though Querystring is secured it s not recommended to transfer sensitive data over querystring    1  Although I need to note that RFC states that browser should not send referrers from HTTPS  to HTTP  But that doesn t mean a bad 3rd party browser toolbar or an external image flash from an HTTPS site won t leak it

User · Answer

I don t agree with the statement about       HTTP referrer leakage  an external image in the target page might leak the password  in Slough s response   The HTTP 1 1 RFC explicitly states      Clients SHOULD NOT include a Referer   header field in a  non-secure  HTTP   request if the referring page was   transferred with a secure protocol    Anyway  server logs and browser history are more than sufficient reasons not to put sensitive data in the query string

User · Answer

SSL first connects to the host  so the host name and port number are transferred as clear text  When the host responds and the challenge succeeds  the client will encrypt the HTTP request with the actual URL  i e  anything after the third slash  and and send it to the server   There are several ways to break this security   It is possible to configure a proxy to act as a  man in the middle   Basically  the browser sends the request to connect to the real server to the proxy  If the proxy is configured this way  it will connect via SSL to the real server but the browser will still talk to the proxy  So if an attacker can gain access of the proxy  he can see all the data that flows through it in clear text   Your requests will also be visible in the browser history  Users might be tempted to bookmark the site  Some users have bookmark sync tools installed  so the password could end up on deli ci us or some other place   Lastly  someone might have hacked your computer and installed a keyboard logger or a screen scraper  and a lot of Trojan Horse type viruses do   Since the password is visible directly on the screen  as opposed to     in a password dialog   this is another security hole   Conclusion  When it comes to security  always rely on the beaten path  There is just too much that you don t know  won t think of and which will break your neck

User · Answer

Yes  from the moment on you establish a HTTPS connection everyting is secure  The query string  GET  as the POST is sent over SSL

User · Answer

From a  sniff the network packet  point of view a GET request is safe  as the browser will first establish the secure connection and then send the request containing the GET parameters  But GET url s will be stored in the users browser history   autocomplete  which is not a good place to store e g  password data in  Of course this only applies if you take the broader  Webservice  definition that might access the service from a browser  if you access it only from your custom application this should not be a problem   So using post at least for password dialogs should be preferred  Also as pointed out in the link littlegeek posted a GET URL is more likely to be written to your server logs

User · Answer

Yes  as long as no one is looking over your shoulder at the monitor

User · Answer

SSL first connects to the host  so the host name and port number are transferred as clear text  When the host responds and the challenge succeeds  the client will encrypt the HTTP request with the actual URL  i e  anything after the third slash  and and send it to the server   There are several ways to break this security   It is possible to configure a proxy to act as a  man in the middle   Basically  the browser sends the request to connect to the real server to the proxy  If the proxy is configured this way  it will connect via SSL to the real server but the browser will still talk to the proxy  So if an attacker can gain access of the proxy  he can see all the data that flows through it in clear text   Your requests will also be visible in the browser history  Users might be tempted to bookmark the site  Some users have bookmark sync tools installed  so the password could end up on deli ci us or some other place   Lastly  someone might have hacked your computer and installed a keyboard logger or a screen scraper  and a lot of Trojan Horse type viruses do   Since the password is visible directly on the screen  as opposed to     in a password dialog   this is another security hole   Conclusion  When it comes to security  always rely on the beaten path  There is just too much that you don t know  won t think of and which will break your neck

User · Answer

You can send password as MD5 hash param with some salt added  Compare it on the server side for auth

User · Answer

Yes  The entire text of an HTTPS session is secured by SSL  That includes the query and the headers  In that respect  a POST and a GET would be exactly the same   As to the security of your method  there s no real way to say without proper inspection

User · Answer

You can send password as MD5 hash param with some salt added  Compare it on the server side for auth

User · Answer

Yes  as long as no one is looking over your shoulder at the monitor

User · Answer

I don t agree with the statement about       HTTP referrer leakage  an external image in the target page might leak the password  in Slough s response   The HTTP 1 1 RFC explicitly states      Clients SHOULD NOT include a Referer   header field in a  non-secure  HTTP   request if the referring page was   transferred with a secure protocol    Anyway  server logs and browser history are more than sufficient reasons not to put sensitive data in the query string

User · Answer

Yes  it is  But using GET for sensitive data is a bad idea for several reasons    Mostly HTTP referrer leakage  an external image in the target page might leak the password 1   Password will be stored in server logs  which is obviously bad  History caches in browsers    Therefore  even though Querystring is secured it s not recommended to transfer sensitive data over querystring    1  Although I need to note that RFC states that browser should not send referrers from HTTPS  to HTTP  But that doesn t mean a bad 3rd party browser toolbar or an external image flash from an HTTPS site won t leak it

User · Answer

Yes  your query strings will be encrypted    The reason behind is that query strings are part of the HTTP protocol which is an application layer protocol  while the security  SSL TLS  part comes from the transport layer  The SSL connection is established first and then the query parameters  which belong to the HTTP protocol  are sent to the server   When establishing an SSL connection  your client will perform the following steps in order  Suppose you re trying to log in to a site named example com and want to send your credentials using query parameters  Your complete URL may look like the following   https   example com login username alice amp password 12345     Your client  e g   browser mobile app  will first resolve your domain name example com to an IP address  124 21 12 31  using a DNS request  When querying that information  only domain specific information is used  i e   only example com will be used  Now  your client will try to connect to the server with the IP address 124 21 12 31 and will attempt to connect to port 443  SSL service port not the default HTTP port 80   Now  the server at example com will send its certificates to your client  Your client will verify the certificates and start exchanging a shared secret key for your session  After successfully establishing a secure connection  only then will your query parameters be sent via the secure connection    Therefore  you won t expose sensitive data  However  sending your credentials over an HTTPS session using this method is not the best way  You should go for a different approach

User · Answer

From a  sniff the network packet  point of view a GET request is safe  as the browser will first establish the secure connection and then send the request containing the GET parameters  But GET url s will be stored in the users browser history   autocomplete  which is not a good place to store e g  password data in  Of course this only applies if you take the broader  Webservice  definition that might access the service from a browser  if you access it only from your custom application this should not be a problem   So using post at least for password dialogs should be preferred  Also as pointed out in the link littlegeek posted a GET URL is more likely to be written to your server logs

User · Answer

Yes  from the moment on you establish a HTTPS connection everyting is secure  The query string  GET  as the POST is sent over SSL

User · Answer

Yes  The entire text of an HTTPS session is secured by SSL  That includes the query and the headers  In that respect  a POST and a GET would be exactly the same   As to the security of your method  there s no real way to say without proper inspection

User · Answer

SSL first connects to the host  so the host name and port number are transferred as clear text  When the host responds and the challenge succeeds  the client will encrypt the HTTP request with the actual URL  i e  anything after the third slash  and and send it to the server   There are several ways to break this security   It is possible to configure a proxy to act as a  man in the middle   Basically  the browser sends the request to connect to the real server to the proxy  If the proxy is configured this way  it will connect via SSL to the real server but the browser will still talk to the proxy  So if an attacker can gain access of the proxy  he can see all the data that flows through it in clear text   Your requests will also be visible in the browser history  Users might be tempted to bookmark the site  Some users have bookmark sync tools installed  so the password could end up on deli ci us or some other place   Lastly  someone might have hacked your computer and installed a keyboard logger or a screen scraper  and a lot of Trojan Horse type viruses do   Since the password is visible directly on the screen  as opposed to     in a password dialog   this is another security hole   Conclusion  When it comes to security  always rely on the beaten path  There is just too much that you don t know  won t think of and which will break your neck

User · Answer

From a  sniff the network packet  point of view a GET request is safe  as the browser will first establish the secure connection and then send the request containing the GET parameters  But GET url s will be stored in the users browser history   autocomplete  which is not a good place to store e g  password data in  Of course this only applies if you take the broader  Webservice  definition that might access the service from a browser  if you access it only from your custom application this should not be a problem   So using post at least for password dialogs should be preferred  Also as pointed out in the link littlegeek posted a GET URL is more likely to be written to your server logs

User · Answer

Yes  your query strings will be encrypted    The reason behind is that query strings are part of the HTTP protocol which is an application layer protocol  while the security  SSL TLS  part comes from the transport layer  The SSL connection is established first and then the query parameters  which belong to the HTTP protocol  are sent to the server   When establishing an SSL connection  your client will perform the following steps in order  Suppose you re trying to log in to a site named example com and want to send your credentials using query parameters  Your complete URL may look like the following   https   example com login username alice amp password 12345     Your client  e g   browser mobile app  will first resolve your domain name example com to an IP address  124 21 12 31  using a DNS request  When querying that information  only domain specific information is used  i e   only example com will be used  Now  your client will try to connect to the server with the IP address 124 21 12 31 and will attempt to connect to port 443  SSL service port not the default HTTP port 80   Now  the server at example com will send its certificates to your client  Your client will verify the certificates and start exchanging a shared secret key for your session  After successfully establishing a secure connection  only then will your query parameters be sent via the secure connection    Therefore  you won t expose sensitive data  However  sending your credentials over an HTTPS session using this method is not the best way  You should go for a different approach

User · Answer

Yes  as long as no one is looking over your shoulder at the monitor

[ssl] Is an HTTPS query string secure?

Examples related to ssl

Examples related to https

Examples related to query-string