Assume there is a request which is going to look up a list of items from a service which requires authorisation (e.g. it's behind a Basic Authentication domain). If the service didn't require authentication, I would always make this request as a GET (it's idempotent). But because the credentials would end up in the query string, I'm basically required to do this as a POST. Is there any alternative to this method?


2 Answers 2


If you let the browser handle the authentication, it will pop-up a login screen. The results will be included in a request header rather than as query parameters. This login header will be included in every request after the user logs in until the browser is closed.

If you want your own login form, then you will need to POST the id and password to keep them from being query parameters. After the login, you need to use a mechanism to track the login. This is usually done with a session id cookie, although there are mechanisms to include the session id in the URL. With session ids the userid and password only need to be sent once. This is more secure, if you allow the user to access the site using HTTP after login. Consider using a secure cookie for the session id if you want to restrict logged in access to HTTPS.

  • I would usually refer to "HTTPs only" cookies as "secure" cookies (to avoid implying contrasting with HttpOnly cookies). Also, I would recommend using a secure, HttpOnly cookie. HttpOnly cookies are not accessible via javascript.
    – Brian
    Jul 30, 2014 at 17:33

It really depends. You could for example have a POST request to query the current time (or the current used memory in the server process, or the number of processed HTTP requests). It has to be a POST because it is not idempotent, but you might decide to accept such a simple status-querying request even without credentials or authentications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.