4 ms·
What do you mean by 'using GET requests for verification'? I think you are mixing different concepts. The problem is caused by URL encoded credentials and has n
by mixedbit 13y ago
What do you mean by 'using GET requests for verification'?
I think you are mixing different concepts. The problem is caused by URL encoded credentials and has nothing to do with GET requests. It is perfectly fine (and often desirable) to authorize GET requests.
- UnoriginalGuy 13y agoYou can only encode credentials in a URL via GET. Therefore if people stop using GET and start using POST (aka forms) for authentication this issue goes away. Even just a simple pin. GET issues are primarily related to the fact that an attacker can automate their access. So they could trick a user into going to a specially crafted site, and then request content on that user's behalf via GET forgery, and return it to the web-server you control. It is very convenient, but fairly insecure.
- jrochkind1 13y agoyou are also ruling out HTTP auth, yes?
- UnoriginalGuy 13y agoIn the context of this discussion I am.