Description
When passwords are included in URLs and sent as part of HTTP queries, they may be logged in various places, including server logs, and disclosed to unauthorized parties through the referer HTTP request header. This risk is heightened when the traffic is not encrypted, making it susceptible to interception and eavesdropping.
Recommendation
Avoid sending sensitive information like passwords in URLs. Instead, use the HTTP POST method and transmit sensitive data in the request body, which is more secure. Additionally, ensure that communication is encrypted using HTTPS to protect data in transit.
References
- Wikipedia: POST (HTTP)
- OWASP: Transport Layer Protection Cheat Sheet
- CWE-16
- CWE-319
- CWE-598
- OWASP 2021-A5