HTTP/HTTPS/GET/POST : in which cases can a malicious router between client and server find a secret information?

Question

Let's say I connect a safe server example.com.

In which case(s) can a malicious router in the middle of the route (or my ISP) see secret?

• 1) HTTP + GET, secret in URL query parameter : http://example.com/mypage?user=abc&secret=238

• 2) HTTPS + GET, secret in URL query parameter : http://example.com/mypage?user=abc&secret=238

• 3) HTTP + POST, secret in request body: user=abc&secret=238

• 4) HTTPS + POST, secret in request body: user=abc&secret=238

?

I think it's true for 1), 3), but I'm unsure about 2).

I'm unsure because I've read that it's not best practice to pass such information via GET (even if HTTPS), but on the other hand, for many APIs, we have to pass auth tokens or api_key via GET requests: https://apiexample.com/endpoint3?api_key=SQKDJHQJSD&action=do123.

Answer 1

As long as the traffic is not protected (i.e. only plain HTTP is used and not HTTPS) a device in the path of the connection (like a malicious router) could in theory read and also modify the data without notice. This includes URL, URL parameter, POST body etc. Of course, the actual capabilities of the devices vary.

If the traffic is protected with HTTPS the body of the request and also the request header including path and URL parameters are protected against sniffing. Domain is part of the TLS handshake but is at least protected against modification too.