Is it secure to pass login credentials as plain text in an HTTPS URL?

Question

Is it secure to pass login credentials as plain text in an HTTPS URL?

https://domain.com/[email protected]&Passwd=123password

Update: So let's say this is not being entered in the browser, but being generated programmatically and being requested with a POST request (not a GET request). Is it secure?

Solution:

It is not secure to use this type of URL in a GET request (i.e. typing the URL into the browser) as the requested URL will be saved in browser history and server logs.

However, it is secure to submit as a POST request to https://domain.com/ClientLogin (i.e. submitting a form) while passing the credentials as part of the POST body, since the POST body is encrypted and sent after making a connection to the requested URL. So, the form action would be https://domain.com/ClientLogin and the form field values will be passed in the POST body.

Here are some links that helped me understand this better:

Answer to StackOverflow Question: Are https URLs encrypted?

Straightforward Explanation of SSL and HTTPS

Google Answers: HTTPS - is URL string itself secure?

HTTP Made Really Easy

Answer 1

No. They won't be seen in transit, but they will remain in:

• browser history
• server logs

If it's at all possible, use POST over HTTPS on authentication, and then set a "authenticated" cookie, or use HTTP Digest Authorization over HTTPS, or even HTTP Basic auth over HTTPS - but whatever you do, don't put secret/sensitive data in the URL.

Edit: when I wrote "use POST", I meant "send sensitive data over HTTPS in POST fields". Sending a POST http://example.com/ClientLogin?password=hunter2 is every bit as wrong as sending it with GET.

TL;DR: Don't put passwords in the URL. Ever.

Answer 2

Yes, but I wouldn't do that.

http://www.ourshop.com/resources/ssl_step1.html

Answer 3

I wouldn't do that. Just the fact that you have "login credentials", "plain text", and "secure" all in the same sentence throws up red flags.

Unless your sentence says "It is not secure to pass login credentials in plain text".

Answer 4

Passing login info in url parameters is not secure, even with SSL

Passing login info in POST body with SSL is considered secure.

If you're using SSL, consider HTTP Basic authentication. While this is horribly problematic without SSL, it is no worse than POST with credentials, it achieves what you want, but does so according to an established standard, rather than custom field names.