{"id":130250,"date":"2009-11-19T10:56:00","date_gmt":"2009-11-19T15:56:00","guid":{"rendered":"tag:blogger.com,1999:blog-7196788127833928948.post-6805376802981225887"},"modified":"2009-11-19T10:56:00","modified_gmt":"2009-11-19T15:56:00","slug":"https-data-exposure-get-vs-post","status":"publish","type":"post","link":"https:\/\/mereja.media\/index\/130250","title":{"rendered":"HTTPS Data Exposure &#8211; GET vs POST"},"content":{"rendered":"<p>Here is a quick chart showing the data exposure when considering GET vs POST and also HTTP vs HTTPS.<\/p>\n<p><a onblur=\"try {parent.deselectBloggerImageGracefully();} catch(e) {}\" href=\"http:\/\/2.bp.blogspot.com\/_Hu1rpxRsqcU\/SwVrcFZyVXI\/AAAAAAAAAW8\/KNtsi1blfiU\/s1600\/Communication_Exposure_Matrix.jpg\"><img decoding=\"async\" style=\"margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 400px; height: 165px;\" src=\"http:\/\/2.bp.blogspot.com\/_Hu1rpxRsqcU\/SwVrcFZyVXI\/AAAAAAAAAW8\/KNtsi1blfiU\/s400\/Communication_Exposure_Matrix.jpg\" alt=\"\" id=\"BLOGGER_PHOTO_ID_5405845057958991218\" border=\"0\" \/><\/a><\/p>\n<ul>\n<li>URL arguments refer to arguments in the URL for GET or POST (e.g. foo.com?arg1=something).<\/li>\n<li>Body arguments refer to data communicated via POST paramaters in the HTTP request body.<\/li>\n<\/ul>\n<p> <span style=\"font-weight: bold;\">NOTE: <\/span>This chart does not address client side caching of temporary files. Caching is a separate issue from the protocol selection and should be addressed with appropriate cache-control headers.<br \/><span style=\"font-weight: bold;\"><br \/><span style=\"font-weight: bold;\">A quick conclusion<\/span><\/span><span style=\"font-weight: bold;\">: The secure choice for transmission of any sensitive data is to use POST statements over SSL\/TLS. Any other option will expose data at some point in the communication.<\/span><\/p>\n<p><\/p>\n<p>This is a guest post by Michael Coates, a senior application security consultant with extensive experience in application security, security code review and penetration assessments. He has conducted numerous security assessments for financial, enterprise and cellular customers world-wide.<\/p>\n<p>The original text is published on<a href=\"http:\/\/michael-coates.blogspot.com\/\"> &#8230;Application Security&#8230;<\/a><\/p>\n<p>Talkback and comments are most welcome<\/p>\n<p>Related posts<br \/><a href=\"http:\/\/www.shortinfosec.net\/2009\/11\/owasp-publishes-top-10-web-app-security.html\">OWASP Publishes Top 10 Web App Security Risks for 2010<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/04\/creating-your-own-web-server.html\">Creating Your Own Web Server<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/03\/having-web-site-that-is-not-that-easy.html\">Web Site that is not Easy to hack &#8211; Part 2 HOWTO<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/02\/having-web-site-that-is-not-that-easy.html\">Web Site that is not that easy to hack &#8211; Part 1 HOWTO<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2009\/03\/tutorial-secure-web-based-job.html\">Tutorial &#8211; Secure Web Based Job Application<\/a><\/p>\n<div class=\"blogger-post-footer\"><img width='1' height='1' src='https:\/\/blogger.googleusercontent.com\/tracker\/7196788127833928948-6805376802981225887?l=www.shortinfosec.net' alt='' \/><\/div>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~r\/shortinfosec\/~4\/UsmcwQBnwkQ\" height=\"1\" width=\"1\"\/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here is a quick chart showing the data exposure when considering GET vs POST and also HTTP vs HTTPS. URL arguments refer to arguments in the URL for GET or POST (e.g. foo.com?arg1=something). Body arguments refer to data communicated via POST paramaters in the HTTP request body. NOTE: This chart does not address client side [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-130250","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/130250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/comments?post=130250"}],"version-history":[{"count":0,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/130250\/revisions"}],"wp:attachment":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/media?parent=130250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/categories?post=130250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/tags?post=130250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}