http://www.perlmonks.org?node_id=888155


in reply to Re: CGI application
in thread CGI application

From a security point-of-view POST and GET are more or less the same. While it is true that POST doesn't show information via the URL, it exposes the same information as a GET in the actual network communication. Some would say using usr/pwd over http is completely unsafe. If security is an issue you better use https, sufficient for most purposes.

Cheers

Harry

Replies are listed 'Best First'.
Re^3: CGI application
by fidesachates (Monk) on Feb 15, 2011 at 16:16 UTC
    Absolutely true. I hadn't considered man in the middle or arp poisoning type attacks where the intruder will actually see the payload of the packets.

    However, what POST protects against is for instance if a website uses a form to reset a password "www.company.com?resetpw=1". Any bored teenager can get unsuspecting users to click a link with that hyperlink embedded and reset that user's password. Obviously there are more dangerous examples than what that one, but it is this type of "attack" that POST will prevent in that the action is not present in the url.