title: Can a username and password be sent safely over HTTPS via URL parameters?
body: <p>A colleague and I had a heated debate yesterday whether it is safe to send login credentials via URL parameters as a means of authentication.  He correctly pointed out that HTTPS encrypts all non-hostname/port characters in a URL before sending a request to the server side.</p>
  
  <p>However, I still think there are edge cases here where it is possible to steal these credentials, and believe they should be sent via an HTTPS POST.  Is this actually a safe means of sending login/token data?</p>