Re: [Cppcms-users] query string

[kpeo <sla...@ya...>]

<div>Agree. My cursory answer on GET's question may be misentrpreted, lead to misunderstanding of web-design concepts, incorrect conclusions and wrong design desicions. Sure, the choice of POST/GET/Ajax should be thoughtful, careful and depends on the current task, environment, compatibility, other factors. In most cases your scenario is correct. BTW, it could seems like Ajax solves all the problems, but its usage has also both advantages and disadvantages for the specific case.<br /><br />Thank you.<br /><br />Best regards,<br />kpeo<br /><br /></div><div>30.09.2015, 19:44, "Joerg Sonnenberger" &lt;jo...@br...&gt;:</div><blockquote type="cite"><p>On Wed, Sep 30, 2015 at 06:48:44PM +0300, kpeo wrote:</p><blockquote> At my point security - is not about the data transferred between the client and<br /> server only.<br /> Browser can store the url with requested data in history / cache. Or URL can be<br /> stored in clipboard, etc.<br /> These data may not contain confidential data, but may contain some personal<br /> information. So GET increases the risks.</blockquote><p><br />Yes, there are specific cases where a POST is useful for idempotent<br />operations. Most of them disappeared with AJAX. Secure tips like "POST<br />is more secure than GET" are the reason why we still have so many<br />extremely bad behaving applications:<br />(1) Using POST because it isn't cached instead of proper cache control.<br />(2) Using POST because it doesn't make things appear in the (client)<br />history.<br />(3) Using POST to prevent C&amp;P.<br /><br />None of this is about security. It is all a form of obscurity at best.<br /><br />The first criterion for GET vs POST should *always* be: does the request<br />change any state? If the request is issued a second time, does something<br />break? If the answer is no, it should *normally* be a GET. There are a<br />few exceptions:<br /><br />(1) You want to pass a lot of data. In the past, some servers liked to<br />complain about passing 200 characters by query string.<br /><br />(2) You have a sensitive query parameter and can't do the query<br />indirectly via AJAX OR can't trust your deployment to have a sane<br />logging configuration.<br /><br />That's about what I can think of after travelling for 12h. If you look<br />at it carefully, the second point doesn't really fix the problem in any<br />way. If you want to pass sensitive data around, encrypt it. Not just the<br />transport, but the individual item as well. Remember, no storing of<br />unencrypted credit card data as example. It's quite a good policy to do<br />that as early as possible.<br /><br />I'm annoyed by such blanket statements, because they almost always lead<br />to bad design decisions upfront by people that don't completely<br />understand the ramnifications. Look at all the web shops still around<br />where you can't just hit the Back button of your browser without getting<br />annoying warnings about having to resubmit form data, even if you are<br />just browsing the catalog.<br /><br />Joerg<br /><br />------------------------------------------------------------------------------<br />_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote>