将敏感数据作为查询字符串参数发送
我们正在审查系统的设计。并且需要验证我们认为可能存在的安全问题。
在此系统中，一些敏感信息在查询字符串中发送。问题是：
- 即使请求是通过 https 发送的，当请求通过 Internet 时，是否可以读取查询字符串参数？
- 可以从客户端计算机上的浏览历史记录中读取查询字符串参数吗？
We are reviewing the design of a system. And need to verify what we think may be a security issue.
In this system some sensitive information is sent in the query string. Question is:
- Can the query string parameters be read as the request goes over the internet, even if the request is sent over https?
- Can the query string parameters be read be read from the browsing history on the client machines?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
当您使用 HTTPS 时，SSL/TLS 连接是在发送任何 HTTP 流量之前建立的，因此整个请求（包括 URL 及其参数）将被加密并且不可读。第三方可能看到的唯一东西是服务器证书（因此他们可以看到主机名，但仅此而已）。
浏览器的历史记录不受 HTTPS 本身的任何方式保护，尽管某些浏览器可能有一些“安全浏览”选项，可能会自动删除一些 HTTPS URL。这最终取决于浏览器及其配置。
When you use HTTPS, the SSL/TLS connection is established before any HTTP traffic is sent, thus the whole request (including the URL and its parameters) will be encrypted and won't be readable. The only thing that's possibly visible by a third party is the server certificate (so they could see the host name, but that's it).
The browser's history isn't protected in any way by HTTPS as such, although some browsers may have some "safe browsing" options which would delete some HTTPS URLs automatically perhaps. This one ultimately really depends on the browser and its configuration.
如果在 get 请求中传递敏感详细信息，这肯定是一个安全问题。
敏感数据不仅会缓存在用户的浏览器中，还会缓存在 d way 上的任何代理中以及网络服务器日志中
This is certainly a security issue if sensitive details are being passed in get request.
Sensitive data will not only get cached in the user's browser but also in any proxy on d way and plus in webserver logs
是的，第一个。不确定第二个 - 我猜取决于浏览器 - 但我怀疑，是的，这里也是如此。
Yes for the first. Not sure about the second - depends on the browser, I guess - but I suspect, Yes, here as well.