Of course it creates a security hole! You are vulnerable to 'reply attacks'. It seems to me that you already know the answer to your question, but are strugglin

Of course it creates a security hole! You are vulnerable to 'reply attacks'. It seems to me that you already know the answer to your question, but are struggling in a last chance to refuse believing the reality. Putting any sensitive information into a url is bound to be exploited sooner or later. Liberally, you can hold the info in urls for the duration of user session but anything beyond that is totally unwise. For the reasons you already mentioned. Other possibilities for unintentional exposing of your personal ulr include: - Users who have google/alexa/amazon/etc. toolbars installed on their browsers, they browse to their personal page, or maybe bookmark it, and alexa/google immediately realize that it is not indexed so they start crawling it. - Other phenomenons like Google Desktop Search crawls and caches all user bookmarks. You should not use http GET method to perform unrelated operations. If you want to offer a delete option to your users, use http POST method. For authentication purposes, i absolutely recommend using HTTPS with POST method.