Re: [Cppcms-users] query string

[kpeo <sla...@ya...>]

<div>Note: "<span>POST/GET/Ajax</span>" - can confuse, because Ajax is not an independent technology, but environment uses POST/GET. But it one of choices in webdev.</div><div> </div><div>30.09.2015, 19:44, "Joerg Sonnenberger" &lt;jo...@br...&gt;:</div><blockquote type="cite"><p>On Wed, Sep 30, 2015 at 06:48:44PM +0300, kpeo wrote:</p><blockquote> At my point security - is not about the data transferred between the client and<br /> server only.<br /> Browser can store the url with requested data in history / cache. Or URL can be<br /> stored in clipboard, etc.<br /> These data may not contain confidential data, but may contain some personal<br /> information. So GET increases the risks.</blockquote><p><br />Yes, there are specific cases where a POST is useful for idempotent<br />operations. Most of them disappeared with AJAX. Secure tips like "POST<br />is more secure than GET" are the reason why we still have so many<br />extremely bad behaving applications:<br />(1) Using POST because it isn't cached instead of proper cache control.<br />(2) Using POST because it doesn't make things appear in the (client)<br />history.<br />(3) Using POST to prevent C&amp;P.<br /><br />None of this is about security. It is all a form of obscurity at best.<br /><br />The first criterion for GET vs POST should *always* be: does the request<br />change any state? If the request is issued a second time, does something<br />break? If the answer is no, it should *normally* be a GET. There are a<br />few exceptions:<br /><br />(1) You want to pass a lot of data. In the past, some servers liked to<br />complain about passing 200 characters by query string.<br /><br />(2) You have a sensitive query parameter and can't do the query<br />indirectly via AJAX OR can't trust your deployment to have a sane<br />logging configuration.<br /><br />That's about what I can think of after travelling for 12h. If you look<br />at it carefully, the second point doesn't really fix the problem in any<br />way. If you want to pass sensitive data around, encrypt it. Not just the<br />transport, but the individual item as well. Remember, no storing of<br />unencrypted credit card data as example. It's quite a good policy to do<br />that as early as possible.<br /><br />I'm annoyed by such blanket statements, because they almost always lead<br />to bad design decisions upfront by people that don't completely<br />understand the ramnifications. Look at all the web shops still around<br />where you can't just hit the Back button of your browser without getting<br />annoying warnings about having to resubmit form data, even if you are<br />just browsing the catalog.<br /><br />Joerg<br /><br />------------------------------------------------------------------------------<br />_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote>