What is the difference between a HTTP-Get and HTTP-POST and why is HTTP-POST weaker in terms of security

by

In an HTTP GET request, key/value pairs are specified in the URL:

http://server/something?value1=foo&value2=bar.

In an HTTP POST request, key/value pairs are sent as part of the HTTP request after the headers. For example:

 POST /something HTTP/1.1
 Host: server
 Content-Length: 21
 Content-Type: application/x-www-form-urlencoded

 value1=foo&value2=bar

It’s hard to really describe one as being more or less secure than the other, but HTTP POST data is not visible in the URL, and when submitting data to a website, an HTTP POST can usually only be performed as a result of user interaction (for example clicking on a “Submit” button).

This means a user can’t be tricked into visiting a URL like http://server/update_profile?name=I_suck and sensitive data is not exposed in the URL.

You can also use nonces and other anti-forgery tokens with html forms (which use POST) to prevent other forms of cross-site request forgeries.

In general, POST should be used for requests that potentially modify state on the server, and GET should be used for read-only operations.

More Related Contents:

  1. 400 BAD request HTTP error code meaning?
  2. SOAP vs REST (differences)
  3. How to design RESTful search/filtering? [closed]
  4. What are best practices for REST nested resources?
  5. How can I handle many-to-many relationships in a RESTful API?
  6. 400 vs 422 response to POST of data
  7. Pagination in a REST web application
  8. How to version REST URIs
  9. How to create REST URLs without verbs?
  10. XDebug and RESTful server using PHPStorm or POSTman
  11. REST Complex/Composite/Nested Resources [closed]
  12. What is the advantage of using REST instead of non-REST HTTP?
  13. What is REST? Slightly confused [closed]
  14. powershell invoke-restmethod multipart/form-data
  15. Transactions across REST microservices?
  16. Designing URI for current logged in user in REST applications
  17. RESTful Services – WSDL Equivalent
  18. What’s the best RESTful method to return total number of items in an object?
  19. Making a PowerShell POST request if a body param starts with ‘@’
  20. Spring 4 RestController JSON: characteristics not acceptable according to the request “accept” headers
  21. Jersey with Struts2 [duplicate]
  22. REST API Authentication
  23. How to download excel (.xls) file from API in postman?
  24. Where can I find jenkins restful api reference? [closed]
  25. Flutter fetched Japanese character from server decoded wrong
  26. HTTP PATCH support in browsers
  27. VSTS use API to set build parameters at queue time
  28. How to do a PUT request with cURL?
  29. What REST PUT/POST/DELETE calls should return by a convention?
  30. Get/post to RESTful web service

Leave a Comment