Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

This answer perpetuates the myth that POST requests are somehow more secure for changing data than GET requests. Even though the question is closed, it’s a top Google hit because Google doesn’t care whether a question is closed.

The answer has gathered a huge number of upvotes, in what seems to be a case of the experts being far outnumbered by the non-experts. The flaws are pointed out in the comments, but nobody edited, deleted, or downvoted the answer as a result.

Is this seen as a problem? What can be done about this? Remember that despite being closed, this still appears in Google and looks rather authoritative to a casual visitor given the number of upvotes. Should this answer or, in fact, the whole question be deleted completely? Or at least marked off-limits to Google?

share|improve this question
Okay, it's been re-opened now. Get some experts to post an answer and we'll mass-upvote it. It'll be hella legit. – Cody Gray Apr 14 '12 at 7:51
up vote 6 down vote accepted

If that seems to be the only answer you have an issue with, go ahead and update it. It's a community wiki for heaven's sake. All the other answers seem to say that neither is more secure than the other. In fact, the answer you linked says that too, it was just hidden in a small sentence at the end of the answer.

There's absolutely no reason this question should be deleted. I'd suggest this question be a candidate for a historical lock.

share|improve this answer
Wait...why does it need to be locked? Why does it even need to be closed? He's asking a specific, answerable question: Is GET more secure than POST, or vice versa? It seems that someone could give an authoritative answer on that without devolving into "discussion". – Cody Gray Apr 13 '12 at 19:51
@TheEstablishment: I only suggest a historical lock because it was closed by a moderator and I would hate for it to be deleted. – animuson Apr 13 '12 at 19:53
Okay, tuned up the question a little bit and voted to re-open. Feel free to cast your vote as well. (I totally think this is a legitimate question. It not only seems answerable, but also quite popular and something that lot of people don't know or worse have incorrect ideas about. Heck, I don't know the answer!) – Cody Gray Apr 13 '12 at 19:57
Hm... are you sure it’s OK to edit an answer with 200 votes to completely reverse its meaning just because it’s CW and I personally think the answer is wrong? – romkyns Apr 14 '12 at 13:22
@romkyns: You shouldn't reverse it's meaning, but in that example, you're not reversing its meaning. The information he had originally provided applies to both methods, then he explained why you should you POST instead. The transition just wasn't very clear. – animuson Apr 14 '12 at 15:40
Done. Hope I did a good job there... :) – romkyns Apr 17 '12 at 17:34

The problem is the question itself, not the answers.

In some aspects, POST is more secure than GET.

  • Sending a password with GET perpetuates it in the history.

  • With standard configuration, every GET request gets logged in Apache's access.log.

In others, it's exactly the same.

  • Forging a POST request is usually as easy as forging a GET request.

  • As already said here by Incognito, POST and GET requests over SSL get equally well encrypted.

As a result, everybody that reads the question actually sees a different one. There is no right answer.

share|improve this answer
Kill the question? I don't think so. – animuson Apr 13 '12 at 18:31
@animuson: On second thought, deletion might be overkill. Some answers contain useful information. But my point stands: It's a badly phrased question that doesn't permit deciding if an answer is correct or wrong. – Dennis Apr 13 '12 at 18:51
Wait. If in some aspects POST is more secure than GET,a nd in other ways, their security is the same, then... POST is more secure than GET overall. So the question does have a right answer. Note that I don't actually know HTTP or anything; I'm going solely off what you're saying here. If there is no circumstance where GET has greater security, then POST is clearly the right answer. – Nicol Bolas Apr 13 '12 at 20:04
@NicolBolas: Hey, you found a third way to interpret the question (which proves that the question is not clear). Technically, you're right. But GET has advantages over POST in some cases (other than security), so thinking of POST as more secure than GET just because it might be is counterproductive oversimplification. – Dennis Apr 13 '12 at 20:20
@Dennis: But the question didn't ask about other uses of the functions; the question asked about the security of the two operations. And only that. The question should be answered as stated; reading into it and trying to divine what the asker is trying to do doesn't help. – Nicol Bolas Apr 13 '12 at 20:22
@NicolBolas: The question has 21 answers. The most upvoted either start with they're euqally secure because..., others with POST is more secure because.... Also, some answers consider security as a synonym for secrecy, others as a synonym for authenticity. If you really attempt to answer the question covering all possible cases, you've got an overly broad question. – Dennis Apr 13 '12 at 20:29
@Dennis: Or just people with different ideas. That's why we allow multiple answers. Some people are more knowledgeable, others are less, others look at things from a certain perspective, etc. And some people are just wrong. From the evidence you've provided, it would appear that the "euqally[sic] secure" people are wrong. It happens. – Nicol Bolas Apr 13 '12 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .