Beefy Boxes and Bandwidth Generously Provided by pair Networks
Problems? Is your data what you think it is?
 
PerlMonks  

Re: CGI application

by fidesachates (Monk)
on Feb 14, 2011 at 18:01 UTC ( #888035=note: print w/replies, xml ) Need Help??


in reply to CGI application

Small tidbit: You probably don't want ?uid=tom&pwd=uy877 to show up in your url. It's unsafe for many reasons. Don't use GET when you're dealing with sensitive informatino or changing databases. Use POST.

Replies are listed 'Best First'.
Re^2: CGI application
by dHarry (Abbot) on Feb 15, 2011 at 08:49 UTC

    From a security point-of-view POST and GET are more or less the same. While it is true that POST doesn't show information via the URL, it exposes the same information as a GET in the actual network communication. Some would say using usr/pwd over http is completely unsafe. If security is an issue you better use https, sufficient for most purposes.

    Cheers

    Harry

      Absolutely true. I hadn't considered man in the middle or arp poisoning type attacks where the intruder will actually see the payload of the packets.

      However, what POST protects against is for instance if a website uses a form to reset a password "www.company.com?resetpw=1". Any bored teenager can get unsuspecting users to click a link with that hyperlink embedded and reset that user's password. Obviously there are more dangerous examples than what that one, but it is this type of "attack" that POST will prevent in that the action is not present in the url.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://888035]
help
Chatterbox?
[Discipulus]: congrats choroba!
Discipulus shutdown and logoff seem untrappable by Perl on win. But it is in Cygwin. but i cannot switch to it
[choroba]: It has the widest rear seats space available in the same price category - needed for the 3 kids.
Discipulus families growth is related to price of cars nowadays..

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (12)
As of 2017-01-17 09:39 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Do you watch meteor showers?




    Results (154 votes). Check out past polls.