HTTPS Data Exposure - GET vs POST

Here is a quick chart showing the data exposure when considering GET vs POST and also HTTP vs HTTPS. The secure choice for transmission of any sensitive data is to use POST statements over SSL/TLS. Any other option will expose data at some point in the communication.

• URL arguments refer to arguments in the URL for GET or POST (e.g. foo.com?arg1=something).
• Body arguments refer to data communicated via POST paramaters in the HTTP request body.

This chart does not address client side caching of temporary files. Caching is a separate issue from the protocol selection and should be addressed with appropriate cache-control headers.

-Michael Coates