Should I use GET or POST when requesting sensitive data?
<p>Should I use <code>GET</code> or <code>POST</code> for retrieving sensitive data, given that:</p>
<ul>
<li>The response will contain sensitive data.</li>
<li>There are side-effects to the request (such as explicit accountability logging).</li>
</ul>
<p>The <a href="https://www.rfc-editor.org/rfc/rfc2616" rel="nofollow noreferrer">RFC 2616</a>, to me, doesn't clarify this for me:</p>
<blockquote>
<p><a href="https://www.rfc-editor.org/rfc/rfc2616#section-9.1.1" rel="nofollow noreferrer"><strong>9.1.1 Safe Methods</strong></a></p>
<p>Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a <code>GET</code> request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the side-effects, so therefore cannot be held accountable for them. [...]</p>
</blockquote>