Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Assume there is a request which is going to look up a list of items from a service which requires authorisation (e.g. it's behind a Basic Authentication domain). If the service didn't require authentication, I would always make this request as a GET (it's idempotent). But because the credentials would end up in the query string, I'm basically required to do this as a POST. Is there any alternative to this method?

share|improve this question
You might want to use HTTP cookies; they also work with GET requests. – Basile Starynkevitch Jul 30 '14 at 11:18

If you let the browser handle the authentication, it will pop-up a login screen. The results will be included in a request header rather than as query parameters. This login header will be included in every request after the user logs in until the browser is closed.

If you want your own login form, then you will need to POST the id and password to keep them from being query parameters. After the login, you need to use a mechanism to track the login. This is usually done with a session id cookie, although there are mechanisms to include the session id in the URL. With session ids the userid and password only need to be sent once. This is more secure, if you allow the user to access the site using HTTP after login. Consider using a secure cookie for the session id if you want to restrict logged in access to HTTPS.

share|improve this answer
I would usually refer to "HTTPs only" cookies as "secure" cookies (to avoid implying contrasting with HttpOnly cookies). Also, I would recommend using a secure, HttpOnly cookie. HttpOnly cookies are not accessible via javascript. – Brian Jul 30 '14 at 17:33

It really depends. You could for example have a POST request to query the current time (or the current used memory in the server process, or the number of processed HTTP requests). It has to be a POST because it is not idempotent, but you might decide to accept such a simple status-querying request even without credentials or authentications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.