Re: When GET = POST?

[Vincent Janelle <random () goblinstudios com>]

Jonas Anden wrote:

> > There are two reasons to consider using POST vs GET methods that come to 
> > mind from a developer perspective.
> >
> > 	1. Obfuscation: POST hides the variables from the URL that can be 
> > easily seen in any web browser. This makes any possible attacker have to 
> > work harder to check what variables and data types are passed in a post 
> > form.
> >
> > 	2. Amount of data and non-text data types: You can not pass binary 
> > data in the query string of a URL. Additionally, the HTTP RFCs limit the 
> > amount of data that can be passed in a GET header significantly to that 
> > in a POST header.
> >    
>
> Actually, I consider the biggest reason for using POST instead of GET is
> that since GET requests are part of the URL, they are generally logged.
> Consider the case where you pass sensitive data such as credit card
> numbers through a GET request. Doesn't matter how well you encrypt your
> database or your session, the credit card numbers still appear in clear
> text in the web server logs.
>
>  // J
>
>  
The reason is that most browsers/webservers have a limit on the size of 
a get request.  Most people weren't worried about sending credit card 
information over the net way back in the day :\