https URL with token parameter : how secure is it?

by

SSL will protect the query parameters in transit; however, email itself is not secure, and the email could bounce along any number of servers before getting to its destination.

Also depending on your web server the full URL might get logged in its log files. Depending on how sensitive the data is you might not want your IT people having access to all the tokens.

Additionally the URL with the query string would be saved in your user’s history, allowing other users of the same machine to access the URL.

Finally and what makes this very insecure is, the URL is sent in the Referer header of all requests for any resource, even third party resources. So if you’re using Google Analytics for example, you will send Google the URL token in and all to them.

In my opinion this is a bad idea.

More Related Contents:

  1. If you use HTTPS will your URL params will be safe from sniffing? [duplicate]
  2. How to redirect all HTTP requests to HTTPS
  3. Are querystring parameters secure in HTTPS (HTTP + SSL)? [duplicate]
  4. What is token-based authentication?
  5. Will web browsers cache content over https
  6. Are HTTPS headers encrypted?
  7. Best way to handle security and avoid XSS with user entered URLs
  8. With HTTPS, are the URL and the request headers protected as the request body is?
  9. Username and password in https url
  10. Should I hash the password before sending it to the server side?
  11. Is it secure to submit from a HTTP form to HTTPS?
  12. SSL Error: unable to get local issuer certificate
  13. Is HTTP header Referer sent when going to a http page from a https page?
  14. curl – Is data encrypted when using the –insecure option?
  15. How to redirect all HTTP requests to HTTPS using .htaccess rules?
  16. WS on HTTP vs WSS on HTTPS
  17. Why not use HTTPS for everything?
  18. Best practices for server-side handling of JWT tokens [closed]
  19. Salt Generation and open source software
  20. Remove Server Response Header IIS7
  21. Preventing Brute Force Logins on Websites
  22. Does HTML5 allow you to interact with local client files from within a browser
  23. Docker and securing passwords
  24. Is JSONP safe to use?
  25. Is it safe to enable ”Access-Control-Allow-Origin: *“ (wildcard) for a public and readonly webservice?
  26. Where is the PEM file format specified?
  27. Difference between CSRF and X-CSRF-Token
  28. How do I secure REST API calls?
  29. What are best practices for securing the admin section of a website? [closed]
  30. Has Hardware Lock Elision gone forever due to Spectre Mitigation?

Leave a Comment