By secure if you mean not exposing all the data passed, then _path is better as it generates a relative url, something like '/login' but _path would give 'http://localhost:3000/login'. Please refer to this blog post i found sometime back regarding the same. When _url is better than _path