title: Are security concerns sending a password using a GET request over https valid?
body: <p>We have webpage which uses  the <a href="/questions/tagged/sapui5" class="post-tag" title="show questions tagged &#39;sapui5&#39;" rel="tag">sapui5</a>-framework to build a <a href="/questions/tagged/spa" class="post-tag" title="show questions tagged &#39;spa&#39;" rel="tag">spa</a>. The communication between the browser and the server uses <a href="/questions/tagged/https" class="post-tag" title="show questions tagged &#39;https&#39;" rel="tag">https</a>. The interaction to log into the page is the following:</p>
  <ol>
  <li>The user opens the website by entering <code>https://myserver.com</code> in the browser</li>
  <li>A login dialogue with two form fields for unsername and password is shown.</li>
  <li>After entering <code>username</code> and <code>password</code> and pressing the <code>login-button</code></li>
  <li>an ajax-request is send using <code>GET</code> to the URL: <code>https://myusername:myPassword@myserver.com/foo/bar/metadata</code></li>
  </ol>
  <p>According to my understanding using GET to send sensitive data is never a good idea. But this answer to <a href="http://answers.google.com/answers/threadview/id/758002.html" rel="noreferrer">HTTPS is the url string secure</a> says the following</p>
  <pre><code>HTTPS Establishes an underlying SSL conenction before any HTTP data is
  transferred. This ensures that all URL data (with the exception of
  hostname, which is used to establish the connection) is carried solely
  within this encrypted connection and is protected from
  man-in-the-middle attacks in the same way that any HTTPS data is.
  </code></pre>
  <p>An in another answer in the same thread:</p>
  <pre><code>These fields [for example form field, query strings] are stripped off
  of the URL when creating the routing information in the https packaging 
  process by the browser and are included in the encrypted data block.
  
  The page data (form, text, and query string) are passed in the
  encrypted block after the encryption methods are determined and the
  handshake completes.
  </code></pre>
  <p>But it seems that there still might be security concerns using <a href="/questions/tagged/get" class="post-tag" title="show questions tagged &#39;get&#39;" rel="tag">get</a>:</p>
  <ul>
  <li><a href="https://stackoverflow.com/a/4078443/819887">the URL is stored in the logs on the server</a> and in the same thread</li>
  <li><a href="https://stackoverflow.com/a/17905738/819887">leakage through browser history</a></li>
  </ul>
  <p>Is this the case for URLs like?</p>
  <pre><code>    https://myusername:myPassword@myserver.com/foo/bar/metadata
      // or 
      https://myserver.com/?user=myUsername&amp;pass=MyPasswort
  </code></pre>
  <p>Additional questions on this topic:</p>
  <ul>
  <li>Is <a href="https://stackoverflow.com/questions/13828046/passing-get-variables-over-ssl-secured">passsing get variables over ssl secure</a></li>
  <li>Is <a href="https://stackoverflow.com/questions/18245096/is-sending-a-password-in-json-over-https-considered-secure">sending a password in json over https considered secure</a></li>
  <li><a href="https://stackoverflow.com/questions/9457769/how-to-send-securely-passwords-via-get-post">How to send securely passwords via GET/POST?</a></li>
  </ul>
  <p>On security.stackexchange are additional informations:</p>
  <ul>
  <li><a href="https://security.stackexchange.com/questions/30976/can-urls-be-sniffed-when-using-ssl">can urls be sniffed when using ssl</a></li>
  <li><a href="https://security.stackexchange.com/questions/12531/ssl-with-get-and-post">ssl with get and post</a></li>
  </ul>
  <p>But in my opinion a few aspects are still not answered</p>
  <h2>Question</h2>
  <p>In my opinion the mentioned points are valid objections to not use get. Is the case; is using get for sending passwords a bad idea?</p>
  <p>Are these the attack options, are there more?</p>
  <ul>
  <li>browser history</li>
  <li>server logs (assuming that the url is stored in the logs unencrypted or encrypted)</li>
  <li>referer information (if this is really the case)</li>
  </ul>
  <p>Which attack options do exist when sending sensitive data (password) over https using get?</p>
  <p>Thanks</p>