Yes you guys are right, and I am not. Sorry. It is still bad practice since the unencrypted URL can be stored in server logs which could be problematic dependi

Yes you guys are right, and I am not. Sorry. It is still bad practice since the unencrypted URL can be stored in server logs which could be problematic depending on the application, security requirements, compliance requirements, etc. Unencrypted URLs are also stored in the browser history which would not matter unless the API is being called in the browser. http://stackoverflow.com/questions/499591/are-https-urls-encrypted http://stackoverflow.com/questions/499591/are-https-urls-enc...