Vulnerability library
Security checkMay 13, 2024

Password Sent in Query

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

Low severityApplication Misconfiguration

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

When passwords are included in URLs and sent as part of HTTP queries, they may be logged in various places, including server logs, and disclosed to unauthorized parties through the referer HTTP request header. This risk is heightened when the traffic is not encrypted, making it susceptible to interception and eavesdropping.

Recommendation

Avoid sending sensitive information like passwords in URLs. Instead, use the HTTP POST method and transmit sensitive data in the request body, which is more secure. Additionally, ensure that communication is encrypted using HTTPS to protect data in transit.

References

Could your website be exposed too?

SmartScanner can check your website for Password Sent in Query and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

How do hackers hack websites?

5 Security Vulnerabilities You Can Fix Right Now

Should I Hide My Admin Login Page? Yes, You Should!

See something that needs correcting? Let us knowUpdated May 13, 2024