What is the difference between a HTTP-Get and HTTP-POST and what is HTTP-POST security it weak.

Question

Can anyone explain the difference between a HTTP-GET and HTTP-POST? And why do people say that a HTTP-POST is unsecured then a GET?

Answer 1

Part 1 of your question is a duplicate of several previous questions:

http://stackoverflow.com/questions/506286/http-get-and-post

As for part 2 I'm not quite sure what you mean by POST being unsecured but a GET request is the less secure of the two considering that all of the form contents submitted over GET are displayed in the browser URL and then stored in server logs and browser history.

Answer 2

I wouldn't call POST more or less secure than GET. Admittedly parameters are displayed as part of the URL when using GET, so any sensitive data will be immediately visible to the user. However, it is trivial to view and even change any part of the HTTP request, so just because POST doesn't pass data through the URL it can still easily be read. Unless you're using HTTPS both GET and POST will transfer data in an easily accessible form.

Answer 3

The GET method is meant for data retrieval only and should not have any side-effects. But POST is meant for that specific purpose: altering data on the server side.

GET requests can easily be foreged (see Cross-Site Request Forgery) by just placing an image on a page while forging POST requests is not that easy (this is also a reason why you should only allow authorized POST requests).

Answer 4

The HTTP specification differentiates POST and GET in terms of their intent:

GET is idempotent: it is for obtaining a resource, without changing anything on the server. As a consequence it should be perfectly safe to resubmit a GET request.

POST is not: it is for updating information on the server. It can therefore not be assumed that it is safe to re-submit the request which is why most browsers ask for confirmation when you hit refresh on a POST request.

In terms of security, no difference. POST is more obscure, perhaps, but that's a very different thing. Security needs to be added at another layer, for example SSL.

Answer 5

Here is the good article that explains HTTP POST and HTTP GET request
http://patelshailesh.com/index.php/http-get-and-http-post-in-asp-net