5 ms·
URLs leak in a bunch of ways. Cached in browsers and proxies, sent in referers, sent in toolbar requests, logged in access.log files. I'm not saying that it's
by danielweber 11y ago
URLs leak in a bunch of ways. Cached in browsers and proxies, sent in referers, sent in toolbar requests, logged in access.log files.
I'm not saying that it's necessarily wrong to use a long URL as security; sometimes the problem constraint means that is the only way to do it. I've done it on rare occasion. But I also made sure that management knew there was a risk here.
- rkangel 11y agoIf that URL is being sent over an HTTPS link (which of course it should be) then the only two points that can log/cache it are the browser at the local end, and the server at the remote end. The latter is up to server design, the former is an interesting point. Browsers are unlikely to cache get parameters, but these things might end up in history etc..
- jessaustin 11y agoThe "Referer" header can also leak URLs.