7

This answer perpetuates the myth that POST requests are somehow more secure for changing data than GET requests. Even though the question is closed, it’s a top Google hit because Google doesn’t care whether a question is closed.

The answer has gathered a huge number of upvotes, in what seems to be a case of the experts being far outnumbered by the non-experts. The flaws are pointed out in the comments, but nobody edited, deleted, or downvoted the answer as a result.

Is this seen as a problem? What can be done about this? Remember that despite being closed, this still appears in Google and looks rather authoritative to a casual visitor given the number of upvotes. Should this answer or, in fact, the whole question be deleted completely? Or at least marked off-limits to Google?

Improve this question
1
  • Okay, it's been re-opened now. Get some experts to post an answer and we'll mass-upvote it. It'll be hella legit.
    – Cody Gray
    Commented Apr 14, 2012 at 7:51

2 Answers 2

Reset to default
6

If that seems to be the only answer you have an issue with, go ahead and update it. It's a community wiki for heaven's sake. All the other answers seem to say that neither is more secure than the other. In fact, the answer you linked says that too, it was just hidden in a small sentence at the end of the answer.

There's absolutely no reason this question should be deleted. I'd suggest this question be a candidate for a historical lock.

Improve this answer
6
  • 3
    Wait...why does it need to be locked? Why does it even need to be closed? He's asking a specific, answerable question: Is GET more secure than POST, or vice versa? It seems that someone could give an authoritative answer on that without devolving into "discussion".
    – Cody Gray
    Commented Apr 13, 2012 at 19:51
  • @TheEstablishment: I only suggest a historical lock because it was closed by a moderator and I would hate for it to be deleted.
    – animuson StaffMod
    Commented Apr 13, 2012 at 19:53
  • 2
    Okay, tuned up the question a little bit and voted to re-open. Feel free to cast your vote as well. (I totally think this is a legitimate question. It not only seems answerable, but also quite popular and something that lot of people don't know or worse have incorrect ideas about. Heck, I don't know the answer!)
    – Cody Gray
    Commented Apr 13, 2012 at 19:57
  • Hm... are you sure it’s OK to edit an answer with 200 votes to completely reverse its meaning just because it’s CW and I personally think the answer is wrong?
    – RomanSt
    Commented Apr 14, 2012 at 13:22
  • @romkyns: You shouldn't reverse it's meaning, but in that example, you're not reversing its meaning. The information he had originally provided applies to both methods, then he explained why you should you POST instead. The transition just wasn't very clear.
    – animuson StaffMod
    Commented Apr 14, 2012 at 15:40
  • Done. Hope I did a good job there... :)
    – RomanSt
    Commented Apr 17, 2012 at 17:34
1

The problem is the question itself, not the answers.

In some aspects, POST is more secure than GET.

  • Sending a password with GET perpetuates it in the history.

  • With standard configuration, every GET request gets logged in Apache's access.log.

In others, it's exactly the same.

  • Forging a POST request is usually as easy as forging a GET request.

  • As already said here by Incognito, POST and GET requests over SSL get equally well encrypted.

As a result, everybody that reads the question actually sees a different one. There is no right answer.

Improve this answer
7
  • 3
    Kill the question? I don't think so.
    – animuson StaffMod
    Commented Apr 13, 2012 at 18:31
  • @animuson: On second thought, deletion might be overkill. Some answers contain useful information. But my point stands: It's a badly phrased question that doesn't permit deciding if an answer is correct or wrong.
    – Dennis
    Commented Apr 13, 2012 at 18:51
  • Wait. If in some aspects POST is more secure than GET,a nd in other ways, their security is the same, then... POST is more secure than GET overall. So the question does have a right answer. Note that I don't actually know HTTP or anything; I'm going solely off what you're saying here. If there is no circumstance where GET has greater security, then POST is clearly the right answer.
    – Nicol Bolas
    Commented Apr 13, 2012 at 20:04
  • @NicolBolas: Hey, you found a third way to interpret the question (which proves that the question is not clear). Technically, you're right. But GET has advantages over POST in some cases (other than security), so thinking of POST as more secure than GET just because it might be is counterproductive oversimplification.
    – Dennis
    Commented Apr 13, 2012 at 20:20
  • @Dennis: But the question didn't ask about other uses of the functions; the question asked about the security of the two operations. And only that. The question should be answered as stated; reading into it and trying to divine what the asker is trying to do doesn't help.
    – Nicol Bolas
    Commented Apr 13, 2012 at 20:22
  • @NicolBolas: The question has 21 answers. The most upvoted either start with they're euqally secure because..., others with POST is more secure because.... Also, some answers consider security as a synonym for secrecy, others as a synonym for authenticity. If you really attempt to answer the question covering all possible cases, you've got an overly broad question.
    – Dennis
    Commented Apr 13, 2012 at 20:29
  • 1
    @Dennis: Or just people with different ideas. That's why we allow multiple answers. Some people are more knowledgeable, others are less, others look at things from a certain perspective, etc. And some people are just wrong. From the evidence you've provided, it would appear that the "euqally[sic] secure" people are wrong. It happens.
    – Nicol Bolas
    Commented Apr 13, 2012 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .