1

I know very well that using GET method and passing request parameters in URL is a bad practice and security vulnerability . But we are in a situation where project development is almost completed and we can not afford to change all the GET to POST and re-test the whole thing all over again.

Is there a way to change the displayed URL ?

Or URL encoding will do the job ? Please suggest what could be the best approach in this situation.

Andrea Ligios
  • 49,480
  • 26
  • 114
  • 243
Mohammed Anwar
  • 75
  • 8
  • 1
    Where did you get that idea? The right method for the right purposes. – Aleksandr M Jul 27 '15 at 08:04
  • I was looking for a quick fix to buy time , will definitely fixed it with the legitimate approach in next project iteration ;) – Mohammed Anwar Jul 27 '15 at 11:12
  • 1
    MohammedAnwar, @AleksandrM is telling you that GET doesn't implies a security vulnerability (though querystrings are pretty ugly), and according to the literature, you should use GET for idempotent method (read), and POST for non-idempotent method (insert, update, delete). However the willing to remove querystring is absolutely legit, hence my answer. – Andrea Ligios Jul 27 '15 at 11:56

1 Answers1

1

The way exists, it is the HTML5 History API.

It needs JavaScript and HTML5 compliant browsers, or a javascript fallback for old IE (eg History.js).

Take a look at history.replaceState() and history.pushState() methods: the first alter the current history entry, the second adds a new one (creating noise in back button usage, so I suggest the first).

To remove the QueryString (the ?param1=value1&param2=value2 part) just run this script on page load:

<script>

    $(function(){
        history.replaceState("","",location.href.substring(0,location.href.indexOf("?")));
    });

</script>

While this client-side solution definitely improves clearness and eye candy, I doubt it improves security at all; Post-Redirect-Get would be better, but if you can't, then use this technique.

I generally use PRG in conjunction with this to achieve pretty URLs, and it works perfectly.

Note that this is a simulated PRG, an F5 after the page is loaded might have unpredictable behaviors according to how you've programmed your application.

Andrea Ligios
  • 49,480
  • 26
  • 114
  • 243