We are reviewing the design of a system. And need to verify what we think may be a security issue.

In this system some sensitive information is sent in the query string. Question is:

* Can the query string parameters be read as the request goes over the internet, even if the request is sent over https?
* Can the query string parameters be read be read from the browsing history on the client machines?