HTTP Query Session Check - Session In HTTP Query

Description

So at the network level, URL parameters are secure, but there are some other ways in which URL based data can leak:

• URLs are stored in web server logs - typically the whole URL of each request is stored in a server log. This means that any sensitive data in the URL (e.g. a password) is being saved in clear text on the server. Query strings may be stored in the server log when a query string was used to send a password over HTTPS, e.g. 2017-03-03 17:59:59 W3SVC4326 WWW 192.168.1.1 GET /Default.htm password=mypassword 443
• URLs are stored in the browser history - browsers save URL parameters in their history even if the secure pages themselves are not cached.
• URLs are passed in Referrer headers - if a secure page uses resources, such as javascript, images or analytics services, the URL is passed in the Referrer request header of each embedded request. Sometimes the query string parameters may be delivered to and stored by third party sites.