WebApp Sec mailing list archives
Re: GET and POST Methods Accepted
From: John GALLET <john.gallet () wanadoo fr>
Date: Fri, 14 Oct 2005 08:29:35 +0200 (CEST)
Hi there,
Using GET on a login page for example: The authentication parameters shall be logged on the server. Nice way to harvent account info if you can get your hands on the logs.
design != runtime. I totally agree on what you wrote. But the question was : "is there any reason to check at runtime whether the data was sent over GET or POST". Everyone agrees it is a design issue and you must be careful not using the GET method in some cases, basically whenenever sensitive data is sent, but it is totally useless checking *at runtime* that these choices were indeed respected by the sending party, for example to detect an intrusion, as is it so easy to provide your application with the (bad) data in the correct (chosen at design) means. JG
Current thread:
- Re: GET and POST Methods Accepted, (continued)
- Re: GET and POST Methods Accepted Joe Teff (Oct 12)
- Re: GET and POST Methods Accepted christopher baus (Oct 12)
- Re: GET and POST Methods Accepted Stephen de Vries (Oct 13)
- Re: GET and POST Methods Accepted christopher baus (Oct 13)
- Re: GET and POST Methods Accepted Stephen de Vries (Oct 13)
- Re: GET and POST Methods Accepted Damien Watson (Oct 13)
- Re: GET and POST Methods Accepted Serg Belokamen (Oct 13)
- Re: GET and POST Methods Accepted Eoin Keary (Oct 13)
- Re: GET and POST Methods Accepted Amit Klein (AKsecurity) (Oct 13)
- Re: GET and POST Methods Accepted John GALLET (Oct 13)
- Re: GET and POST Methods Accepted Eoin Keary (Oct 13)
- Re: GET and POST Methods Accepted John GALLET (Oct 13)
- Re: GET and POST Methods Accepted Eoin Keary (Oct 13)
- Re: GET and POST Methods Accepted Paul Laudanski (Oct 18)
- RE: GET and POST Methods Accepted Derick Anderson (Oct 13)
- RE: GET and POST Methods Accepted christopher baus (Oct 13)
- RE: GET and POST Methods Accepted Joe Teff (Oct 13)
- RE: GET and POST Methods Accepted christopher baus (Oct 13)
- RE: GET and POST Methods Accepted Derick Anderson (Oct 14)