We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a user is something like: https://www.mysite.com/users/USERNAME_HERE/edit. And of course, that will show up in your browser history.
Is this really a security concern? What about other PII like order numbers (for a retail site)?
It really depends on the nature of the website. If the site already shows the username on other places (like here on this site) then it probably isn’t PII. If the username is show nowhere else, then it might be considered PII.
That being said, why is the username exposed in the url for an edit (apart from being the default for certain frameworks)? Especially since URLs are generally logged and saved in history, it is generally considered a bad practice to use usernames because it could give a hacker information about the usernames used in your system. Given this information and the fact that users tend to reuse passwords, the risks are getting bigger than they should be.
Conceptually yes, anything you disclose that you don't need to is potentially a security risk. It is far easier to guess a password than a username and password. Also plenty of attacks rely on having one or a set of valid user names.
In a web application there is little to no reason to have usernames in URLs, you simply don't need them after authentication. The server knows who is logged in given the session identifier. The user does not need to be informed what their username is. You can use relative references to the logged in user like "session" or "me" or "user" or something and let the server match it to the actual user name if need be.
Here is a reference on PII that is relevant to the US. But you should do research into how PII is defined and what regulations are relevant to PII for wherever you are operating your site. You may also want to look into the same things where you are allowing users to use the site as you may also be held accountable in those locations.
It also may matter what you use as a username (e.g. Legal name, email address, etc)
It also may matter what industry you are operating within and what service you are providing, in case there are any extra regulations that you must follow.
Your customers trust you to protect the data you are holding, and you should err on the side of caution to avoid losing the trust of your customers.
The way to avoid most of these legal headaches, ambiguity, and security/privacy concerns: for this specific use case, is to use tokenization.
Do not expose data directly in urls (i.e. usernames, keys, identifiers, etc), rather map them to a token in session on the server. This way the numbers become meaningless when you expire the session.
In this case:
/users/bob/edit becomes /users/42/edit
I agree with your client and with other answers here, that it is a security concern.
It's not always safe to assume that browser history is private to the user. You don't say who your client is, but if you're in the realm of PII, my mind automatically goes to a healthcare setting. I would be concerned about a HIPAA violation.
A patient may trust logging into their patient portal using a kiosk at a doctor's office, for example. However, another user (even someone on the back end in IT) even seeing the patient name and knowing they are a patient puts the org at risk.
I'm also not sure if you have the best understanding of PII given the question. For example, I'd usually not consider order number PII, of course it depends.
After working in healthcare for the past few years, I've learned that what is considered PII and PHI is often contextual. This is a great definition from the GSA:
"The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available - in any medium and from any source - that, when combined with other available information, could be used to identify an individual."
Order numbers would not usually be considered PII, in my experience. I worked at a wellness company that had a retail component, and order number was not considered PII in our systems, because of the way our databases were structured. However, I can think of a use case for order number being PII. Let's say you have a tracker tool that allows you to put in the order number, and see the location of the package and the full delivery address. Then you're in a situation where order number is revealing sensitive information.
Another definition that I like of PII is this one from the DOL, which says that
"information permitting the physical or online contacting of a specific individual is the same as personally identifiable information."
Yes it is a privacy concern. In general, PII should not appear in the URL. The problem is that the URL is potentially logged in multiple places (the history as you say, or proxies, or even ISP or service provider proxies you are not aware of).
