{"id":618736,"date":"2009-11-19T10:56:00","date_gmt":"2009-11-19T15:56:00","guid":{"rendered":"tag:blogger.com,1999:blog-7196788127833928948.post-6805376802981225887"},"modified":"2009-11-19T10:56:00","modified_gmt":"2009-11-19T15:56:00","slug":"https-data-exposure-get-vs-post","status":"publish","type":"post","link":"https:\/\/mereja.com\/index\/618736","title":{"rendered":"HTTPS Data Exposure &#8211; GET vs POST"},"content":{"rendered":"<p>Here is a quick chart showing the data exposure when considering GET vs POST and also HTTP vs HTTPS.<\/p>\n<p><a onblur=\"try {parent.deselectBloggerImageGracefully();} catch(e) {}\" href=\"https:\/\/i0.wp.com\/2.bp.blogspot.com\/_Hu1rpxRsqcU\/SwVrcFZyVXI\/AAAAAAAAAW8\/KNtsi1blfiU\/s1600\/Communication_Exposure_Matrix.jpg\"><img data-recalc-dims=\"1\" decoding=\"async\" style=\"margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 400px; height: 165px;\" src=\"https:\/\/i0.wp.com\/2.bp.blogspot.com\/_Hu1rpxRsqcU\/SwVrcFZyVXI\/AAAAAAAAAW8\/KNtsi1blfiU\/s400\/Communication_Exposure_Matrix.jpg?w=780\" alt=\"\" id=\"BLOGGER_PHOTO_ID_5405845057958991218\" border=\"0\" \/><\/a><\/p>\n<ul>\n<li>URL arguments refer to arguments in the URL for GET or POST (e.g. foo.com?arg1=something).<\/li>\n<li>Body arguments refer to data communicated via POST paramaters in the HTTP request body.<\/li>\n<\/ul>\n<p> <span style=\"font-weight: bold;\">NOTE: <\/span>This chart does not address client side caching of temporary files. Caching is a separate issue from the protocol selection and should be addressed with appropriate cache-control headers.<br \/><span style=\"font-weight: bold;\"><br \/><span style=\"font-weight: bold;\">A quick conclusion<\/span><\/span><span style=\"font-weight: bold;\">: The secure choice for transmission of any sensitive data is to use POST statements over SSL\/TLS. Any other option will expose data at some point in the communication.<\/span><\/p>\n<p><\/p>\n<p>This is a guest post by Michael Coates, a senior application security consultant with extensive experience in application security, security code review and penetration assessments. He has conducted numerous security assessments for financial, enterprise and cellular customers world-wide.<\/p>\n<p>The original text is published on<a href=\"http:\/\/michael-coates.blogspot.com\/\"> &#8230;Application Security&#8230;<\/a><\/p>\n<p>Talkback and comments are most welcome<\/p>\n<p>Related posts<br \/><a href=\"http:\/\/www.shortinfosec.net\/2009\/11\/owasp-publishes-top-10-web-app-security.html\">OWASP Publishes Top 10 Web App Security Risks for 2010<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/04\/creating-your-own-web-server.html\">Creating Your Own Web Server<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/03\/having-web-site-that-is-not-that-easy.html\">Web Site that is not Easy to hack &#8211; Part 2 HOWTO<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/02\/having-web-site-that-is-not-that-easy.html\">Web Site that is not that easy to hack &#8211; Part 1 HOWTO<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2009\/03\/tutorial-secure-web-based-job.html\">Tutorial &#8211; Secure Web Based Job Application<\/a><\/p>\n<div class=\"blogger-post-footer\"><img width='1' height='1' src='https:\/\/blogger.googleusercontent.com\/tracker\/7196788127833928948-6805376802981225887?l=www.shortinfosec.net' alt='' \/><\/div>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~r\/shortinfosec\/~4\/UsmcwQBnwkQ\" height=\"1\" width=\"1\"\/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here is a quick chart showing the data exposure when considering GET vs POST and also HTTP vs HTTPS. URL arguments refer to arguments in the URL for GET or POST (e.g. foo.com?arg1=something). Body arguments refer to data communicated via POST paramaters in the HTTP request body. NOTE: This chart does not address client side [&hellip;]<\/p>\n","protected":false},"author":288,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4821],"tags":[],"class_list":["post-618736","post","type-post","status-publish","format-standard","hentry","category-news"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p9NivD-2AXC","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/posts\/618736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/users\/288"}],"replies":[{"embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/comments?post=618736"}],"version-history":[{"count":0,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/posts\/618736\/revisions"}],"wp:attachment":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/media?parent=618736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/categories?post=618736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/tags?post=618736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}