Information Exposure Through Query String

php.information_exposure_through_query_string

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Information Leak

Language

Php

Description

Sensitive data — a password, token, secret or API key — is placed in a URL query string.

Rationale

Data in a URL query string is not protected the way a request body is: it is written to web-server and proxy access logs, kept in the browser history, and forwarded in the Referer header to third-party sites. Even over HTTPS the full URL, including the query string, routinely ends up in logs and history. Sending credentials or tokens this way exposes them well beyond the intended endpoint.

// VULNERABLE: the token lands in logs, history and Referer headers
$url = "https://api.example.com/data?access_token=$token";
$login = "https://example.com/login?password=" . $password;

Remediation

Send sensitive values in the request body of a POST/PUT request, or in an Authorization header — never in the URL query string.

// credentials go in the body or an Authorization header, not the query string
$ch = curl_init("https://api.example.com/data");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . $token]);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(["page" => $page]));

References

CWE-598 : Use of GET Request Method With Sensitive Query Strings