• bleistift2@feddit.de
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    cleartext usernames and passwords as the URI components of GET requests

    I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?

    • nudelbiotop@feddit.de
      link
      fedilink
      arrow-up
      9
      ·
      edit-2
      1 year ago

      Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.

      • walkwalkwalkwalk@feddit.uk
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        What do you mean by any involved network infrastructure? The URI is encrypted by TLS, you would only see the host address/domain unless you had access to it after decryption on the server.

    • nijave@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Browser history

      Even if the destination doesn’t log GET components, there could be corporate proxies that MITM that might log the URL. Corporate proxies usually present an internally trusted certificate to the client.