3 ms·
Putting keys in query strings does leak information on the server though. Query strings are usually logged with the request in log files so you have to be sure
by tankerdude 12y ago
Putting keys in query strings does leak information on the server though. Query strings are usually logged with the request in log files so you have to be sure to filter out the specific query string for the session token. That's the security concern that I see, especially if the logs get sent out somewhere/someone else for analysis.
- leeoniya 12y agowell, you need authentication data in every request, which includes GET/DELETE/HEAD/OPTIONS requests with no payload. so either you use query strings (which suffers from the logging issue) or you use headers/cookies which some people argue isn't "REST"ful.