Defining a new HTTP method: HTTP Search (2021)

Re:Defining a new HTTP method: HTTP Search (2021) by time0ut on Saturday May 27, 2023 @11:48AM (#36095683)

A situational issue that I've run into a number of times with GET is various middle boxes inadvertently logging sensitive data that was in the query string of a GET. By sensitive data, I mean PII and CU information. While we have used POST to side step the issue, it'd be nice if there was a more appropriate method.

[ Parent | on HN ]

Re:Defining a new HTTP method: HTTP Search (2021) by AtNightWeCode on Saturday May 27, 2023 @12:40PM (#36096083)

Many logging systems exclude query parameters from the logging by default. It is also fine to include PII data in the logs as long as they are handled correctly and deleted after 30 days. But I have got burned by this problem as well. Like people using PIIs for identifiers.

[ Parent | on HN ]

Re:Defining a new HTTP method: HTTP Search (2021) by Beldin on Saturday May 27, 2023 @01:27PM (#36096498)

But a new HTTP method would require an update to the middle boxes... if you're doing that, you could also consider updating them to avoid the issue you described.

Overall, I'm not necessarily inherently against new HTTP methods. If equipment that is supposed to be transparent to HTTP isn't, should be solved elsewhere, not by a new HTTP method.

[ Parent | on HN ]

Re:Defining a new HTTP method: HTTP Search (2021) by Dylan16807 on Sunday May 28, 2023 @01:20AM (#36101388)

There's no button you can press to get all middleboxes updated.

It's better to fail on the ones that slip through the cracks than to leak data. And the failure alerts people that updates are needed here.

[ Parent | on HN ]