> URLs generally have less protection than a password That's an understatement. Passwords are supposed to be private by design. URLs are not. > because that

> URLs generally have less protection than a password That's an understatement. Passwords are supposed to be private by design. URLs are not. > because that's how we design a lot of our systems (and this is a property of our systems and not of the URLs themselves) That's simply not true. URLs don't have protection because the notion of a private URL is a flat-out contradiction. As I said before: it goes against the fundamental design of the Web. URLs are not in any sense designed to be private. Like, at all. If anything, they are designed not to be private. URLs are by their nature public information[1]. Anyone who believes or wishes otherwise is someone who believes or wishes that the Web is something other than the thing actually proposed, designed, and implemented. Anyone can, at their own peril, try to devise other higher-level systems that exploit implementation details and other incidentals in non-normative ways while trying to justify it on the basis that it jibes with what you have observed in practice. You are also free to design a content-protection scheme that hinges on the whitespace in the client request varying just so, or where the HTTP heADEr naMEs follow a suPEr seCREt caPITALIZATIOn coNVENTIOn, etc. But no one else has any obligation to conform to the expectations necessarily prescribed by those lame designs nor to commit themselves to any action/inaction implied. "Leaking URLs" is a non-offense. 1. <https://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext-driven#comment-806 https://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypert...>