4 ms·
Some people, perhaps most, don't like POST because it is annoying to copy URLs and use the back button. I'm not opposed to making it the default for https, but
by epi0Bauqu 16y ago
Some people, perhaps most, don't like POST because it is annoying to copy URLs and use the back button. I'm not opposed to making it the default for https, but I don't want to make a default that most people don't want either.
- jacquesm 16y agoThat's a good point. Maye you could put a small warning on the page if they disable 'POST' that there might be leakage of their search terms to the sites they visit? "Hello dear user, you probably know exactly what you're doing, but on the off-chance that you don't, please realize that disabling the POST option for https connections may leak your search terms to the visiting site". Or something to that effect.
- mike-cardwell 16y agoThe problem is not that the referer leaks to the sites you click through to. The referer leaks to sites as soon as the results page is displayed because there are externally hosted images embedded in the results page.
- jacquesm 16y agoBut a post would take care of that right ? After all, then the referring url would just be the search page without any parameters. So if you switch off the post then leakage would occur, with the 'post' enabled you're fine. edit: I see what you mean now, if they switch to 'get' mode it leaks the info even to sites they don't visit. One more good reason to use that post!
- orblivion 16y agoBut what's the point of an https search if it's not really secure? The only thing the user is trying to hide is the query, and it's not being entirely hidden. For users who are annoyed, you could explain to them somewhere on the site that you don't put it in the URL because it exposes their query. If they really want a secure search, I imagine they'll understand the tradeoff.