GET or POST, two Guys asked me that in the last month so I want to clearify that.
You know that?:
https://www.privacy.safe/donation.php?fname=John&lname=Doe&IBAN=GB19123412341234123412
I often see that the GET-option is used in web forms and sometimes I have to enter privacy relevant informations.
But the problem is that GET-arguments will be shown in the browser's history and address field. Moreover addons like "Ghostery" (german), to call one of them, spy on you. Ghostery had advertising companies as business partners and sold the full URL of accessed pages to them. Ghostery's statement at this time was that they will mask any personal information before transmitting it to their partners. But then the german public TV-broadcaster "NDR" disclosured that they got a demo data record from one of Ghostery's advertising partners that contained personal informations. The data record was a list of accessed websites that where caught by the Ghostery addon installed on innocent's PCs.
Some time ago a few genious developers coded a webshop and the price was in the GET-argument. I think you can conclude the rest...
So you should use POST- instead of GET-options if you don't have a reason to do it on the other way.
Cases where you can use GET-options are:
- Commands like
https://my-raspberry.pi/smarthome?device=light_bedroom&power_percent=40&col=FF0000to set as bookmark if your girlfriend comes back home - URLs you want to be shared with arguments
- For a search field (that it can be changed in the URL)
- For testing :)
- Something that I forgot here because i think to complicated...
Can you add anything that I didn't catch? I'm waiting for your feedback.
Btw: If you search something to hack: Juice-Shop