I read that sending usernames via query parameters is not a good practice
Where have you read that?
There are a few things you should take care of when sending anything through a query parameter of an HTTP GET:
Sensitive information. Putting such information in the URI is plainly wrong. Although query parameters are encrypted when using HTTPS, those parameters are still usually saved in a non-secure way. HTTP logs are one of the examples where sensitive information has no place.
Long parameters. Although HTTP is quite permissive when it comes to long URIs, your infrastructure may not be that permissive. For instance, the default limit (which can be changed easily) for an entire URI in HAProxy is 8K, and some applications could expect shorter URIs.
Unicode characters. By itself, Unicode characters in URIs have nothing wrong, however, you have to ensure your application handles them correctly both when sending them (through AJAX or hyperlinks) and receiving them on server side.
Security. If an URI such as https://example.com/login/user1 logs in the user
user1, this may not be what you want in terms of security. More seriously, never trust any input, and this rule includes the user name: the fact that someone told you in the request that he's the
user1 doesn't mean anything. Do ensure that usernames are used in a correct context. An example of a correct context would be https://example.com/profile/user1, a page which leads to the public profile of the user, or, similarly, https://blog.example.com/posts/user1.
Usernames are not sensitive information: they are often the only information about the user which is public. They are not expected to be extremely long either, or you'll probably have more important concerns than the length of your URIs anyway. They can and usually will contain Unicode characters, but as soon as you check that your app handles that well, there is no issue there either. Same goes for the security: if you use the input wrongly, you'll still have the exact same issue with HTTP headers or any form of input.
So no, you don't have to “hide” usernames anywhere, would it be in the HTTP headers, cookies or request body.