Information Exposure Through Query String

csharp.information_exposure_through_query_string

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Information Leak

Language

CSharp

Description

Sensitive data — a password, token, secret or API key — is placed in a URL query string.

Rationale

Data in a URL query string is not protected the way a request body is: it is written to web-server and proxy access logs, kept in the browser history, and forwarded in the Referer header to third-party sites. Even over HTTPS the full URL, including the query string, routinely ends up in logs and history. Sending credentials or tokens this way exposes them well beyond the intended endpoint.

// VULNERABLE: reading a secret from the query string (endpoint expects it in the URL)
var pwd = context.Request.Query["password"];

// VULNERABLE: building a URL whose query string carries a secret
// (the token lands in logs, history and Referer headers)
var url = $"https://api.example.com/data?access_token={token}";
var login = "/account/login?password=" + password;

Remediation

Send sensitive values in the request body of a POST/PUT request, or in an Authorization header — never in the URL query string.

using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.example.com/data");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
// credentials go in the body, form-encoded or JSON, not the query string

References

CWE-598 : Use of GET Request Method With Sensitive Query Strings