3 ms·
A situational issue that I've run into a number of times with GET is various middle boxes inadvertently logging sensitive data that was in the query string of a
by time0ut 3y ago
A situational issue that I've run into a number of times with GET is various middle boxes inadvertently logging sensitive data that was in the query string of a GET. By sensitive data, I mean PII and CU information. While we have used POST to side step the issue, it'd be nice if there was a more appropriate method.
- AtNightWeCode 3y agoMany logging systems exclude query parameters from the logging by default. It is also fine to include PII data in the logs as long as they are handled correctly and deleted after 30 days. But I have got burned by this problem as well. Like people using PIIs for identifiers.
- Beldin 3y agoBut a new HTTP method would require an update to the middle boxes... if you're doing that, you could also consider updating them to avoid the issue you described. Overall, I'm not necessarily inherently against new HTTP methods. If equipment that is supposed to be transparent to HTTP isn't, should be solved elsewhere, not by a new HTTP method.
- Dylan16807 3y agoThere's no button you can press to get all middleboxes updated. It's better to fail on the ones that slip through the cracks than to leak data. And the failure alerts people that updates are needed here.