Is either GET or POST more secure than the other?

前端 未结 27 2104
没有蜡笔的小新
没有蜡笔的小新 2020-11-22 05:13

When comparing an HTTP GET to an HTTP POST, what are the differences from a security perspective? Is one of the choices inherently more secure than the other? If so, why?

27条回答
  •  抹茶落季
    2020-11-22 05:59

    One reason POST is worse for security is that GET is logged by default, parameters and all data is almost universally logged by your webserver.

    POST is the opposite, it's almost universally not logged, leading to very difficult to spot attacker activity.

    I don't buy the argument "it's too big", that's no reason to not log anything, at least 1KB, would go a long way for people to identify attackers working away at a weak entry-point until it pop's, then POST does a double dis-service, by enabling any HTTP based back-door to silently pass unlimited amounts of data.

提交回复
热议问题