If a service is sending auth tokens as URL parameters, stop using it. Those are ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		cess11 74 days ago \| parent \| context \| favorite \| on: Chrome extensions spying on users' browsing data If a service is sending auth tokens as URL parameters, stop using it. Those are always public.

dangets 74 days ago | [–]

I don't disagree with the advice (especially for long lived tokens), but query parameters are encrypted during transit with https. You still need to worry about server access logs, browser history, etc that might expose the full request url.

karel-3d 73 days ago | [–]

huh? https encrypts URL parameters?

Consider applying for YC's Summer 2026 batch! Applications are open till May 4
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact