MVC HttpGet and HttpPost

Question

Recently I have attended a training in mvc. The trainer said that - As per the security concerns we have to use HttpPost instead of HttpGet. Always use HttpPost.

Can anyone explain - what is the security issue when we use HttpGet?

Answer 1

When transmitting data over secure connection (https) body of the post request is encrypted and practically undreadable, you can only see address where data is going but not the data itself. Get on the other hand has no body and data has to be transmitted in either query string or as a path parameter. While it is true that query string does get encrypted as well, due to request logging on the server and browser it is possible to get hold of that data.

Answer 2

Anyone can insert image on public forum or stackoverflow with link to your web-site. Then happens next:

1. Browser looks at url in image tag
2. Browser find cookies corresponding to domain in url
3. Browser sends request to url with cookies of user
4. Your server performs action
5. Browser tries to parse response as image and fails
6. Browser renders error instead of image

But if you mark your action as Http Post only then this scenario isn't applicable for 90% of sites. But you should also consider that if hacker can create a form on other web-site then he still can make browser to perform request. So you need CSRF . Well, browsers made a lot to prevent cross-site requests, but it's still possible in some scenarios.