What is the difference between a HTTP-Get and HTTP-POST and why is HTTP-POST weaker in terms of security

Question

Can anyone explain the difference between a HTTP-GET and HTTP-POST? And why do people say that a HTTP-POST is weaker in terms of security?

Answer 1

In an HTTP GET request, key/value pairs are specified in the URL:

http://server/something?value1=foo&value2=bar.

In an HTTP POST request, key/value pairs are sent as part of the HTTP request after the headers. For example:

 POST /something HTTP/1.1
 Host: server
 Content-Length: 21
 Content-Type: application/x-www-form-urlencoded

 value1=foo&value2=bar

It's hard to really describe one as being more or less secure than the other, but HTTP POST data is not visible in the URL, and when submitting data to a website, an HTTP POST can usually only be performed as a result of user interaction (for example clicking on a "Submit" button).

This means a user can't be tricked into visiting a URL like http://server/update_profile?name=I_suck and sensitive data is not exposed in the URL.

You can also use nonces and other anti-forgery tokens with html forms (which use POST) to prevent other forms of cross-site request forgeries.

In general, POST should be used for requests that potentially modify state on the server, and GET should be used for read-only operations.