3 ms·
Are you confident that it doesn't appear anywhere else? There's two main concerns: the first being that you use a URL differently---and think of it differently
by mikegerwitz 11y ago
Are you confident that it doesn't appear anywhere else?
There's two main concerns: the first being that you use a URL differently---and think of it differently---than a password; and the URL persists in various forms.
Accessing a resource on the Web might be logged in numerous places---e.g. your web history and internal network logs or MITM if not over https---and might be sent as metadata, like a referer header to another website. Imagine if all of your passwords were logged by your client any time you entered them in.
- mikegerwitz 11y agoI don't mind downvotes (and this appears to only have been downvoted once), but I do want to express legitimate concern over that: what I said is a standard security concern, and precisely why you don't put sensitive information in GET requests. I hope that others aren't dismissing this issue.