News for hackers. Stuff that matters.

A comment on Safari tries to fill username. Parent comment

Re:Safari tries to fill username by Hackbraten on Friday May 28, 2021 @11:02AM (#27316201)
> Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted

It’s still good practice to keep sensitive info out of URL query parameters, which often leak into server logs.

[ Parent | on HN ]
Re:Safari tries to fill username by detaro on Friday May 28, 2021 @11:05AM (#27316240)
And are (were, maybe modern browsers fixed that by now?) sent in HTTP Referers to linked sites, end up in browser history, ...
[ Parent | on HN ]
Re:Safari tries to fill username by missblit on Friday May 28, 2021 @11:29AM (#27316562)
The current default for the Referer header is to send the complete referrer for same-origin requests, to send the origin for cross-origin requests, and to send nothing if going from HTTPS to HTTP.

This is customizable by setting the referrer policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

[ Parent | on HN ]