From the very first day we learned about sending requests, teachers told us: POST requests are more secure than GET requests.

Why?

In the era of sending requests via forms, GET requests carried information in the URL bar, while POST did not — POST put the information in the request body.

Because GET requests put parameters in the URL bar, others could see them, inevitably exposing some information.

Hence the conclusion: POST is more secure than GET.

Later, a new backend developer joined the company. He said POST was more secure than GET, so without consulting anyone, he designed all new endpoints as POST. When I was integrating, staring at this long list of POST requests, I was totally confused. Having developed for so long, I never thought this was a security concern.

Our frontend was an AngularJS SPA. Every request was sent via Ajax, so there was no case where GET parameters were exposed in the URL bar.

If all endpoints become POST, what would our code look like?

// query data
$http.post("xxx.xxx.xxx")

// create data
$http.post("xxx.xxx.xxx")

// update data
$http.post("xxx.xxx.xxx")

// delete data
$http.post("xxx.xxx.xxx")

All requests are POST, with no semantics whatsoever — a complete mess and very hard to read.

As everyone knows, there are several HTTP request methods:

• GET
• POST
• HEAD
• PUT
• DELETE
• OPTIONS
• TRACE
• CONNECT

There are corresponding methods for CRUD operations, so our code should be:

// query data
$http.get("xxx.xxx.xxx")

// create data
$http.post("xxx.xxx.xxx")

// update data
$http.put("xxx.xxx.xxx")

// delete data
$http.delete("xxx.xxx.xxx")

Summary:

In SPA applications, POST is not inherently more secure than GET. We should use the most appropriate request method for sending and requesting data.

Article Link: