title: Is token based authentication secure when
body: <p>any request is made via HTTPS and the token is transmitted the following ways:</p>
  
  <p>a) GET <a href="https://foo.dom/foobar?auth_token=abcxyz" rel="nofollow">https://foo.dom/foobar?auth_token=abcxyz</a></p>
  
  <p>b) GET <a href="https://foo.dom/foobar" rel="nofollow">https://foo.dom/foobar</a> with HTTP-header like X-FOOBAR-TOKEN: abcxyz</p>
  
  <p>As I understand SSL, in case of an HTTP request the client first negotiates the SSL connection and does only transmit additional parameters and/or HTTP headers in case the secure connection was established successfully. </p>
  
  <p>Am I right so far?</p>
  
  <p>Thx fur any suggestion.
  Felix</p>