Question

I’ve already read bunch of articles regarding the difference between http posts and http get methods. I’m just confused about which of the two is a better option in terms of security. Because, some article said that it is better to use post method rather than get because it did not allow the display of data in the url. But some also said that it is better to use get because it is not involved in updating of data, it is just there to read data and display them. So, which of the two should I choose? Or am I understanding this right? Please help, I need some clarification here… Thanks!

Answer 1

GET and POST are methods/verbs, and—as verbs do in spoken languages, and methods in programming languges—they indicate action. You should pick the method which best fits the operation.

Starting with the definitions:

GET

The GET method means retrieve whatever information (in the form of an
entity) is identified by the Request-URI

POST

The POST method is used to request that the origin server accept the
entity enclosed in the request as a new subordinate of the resource
identified by the Request-URI in the Request-Line.

To generalize, a GET should retrieve, and a POST should create or update. The method chosen is unrelated to security; either can be properly secured or completely insecure.

To put it another way: Just because a POST appears to “hide” the data doesn’t mean it is any more secure.

I suggest also reading about about REST principles.

I would further suggest reading about Idempotence and Safe methods. See § 9.1 of the spec for the direct application of idempotence and nullipotence to HTTP.