Le 26/06/2018 à 13:31, Paul Foxworthy a écrit :
On 26 June 2018 at 17:58, Taher Alkhateeb <[email protected]>
wrote:
I could be mistaken, but this seems like a very major change that did
not have a thorough and proper discussion at the mailing list? I would
rather at least have an explanation of what was committed and to
discuss the merits and cons of the implementation.
Hi all,
I haven't found the specific issue, but wasn't there a major change several
years ago from GET to POST to help guard against XSS attacks?
Cheers
Paul Foxworthy
Hi Paul,
Actually Mathieu is notably working on REST in OFBiz.
In REST GET, as others methods, are used.
Normally, as its name "GET" shows, only for retrieval.
During retrieval an XSS attack should not be feared if, as pointed out at
https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Sensitive_information_in_HTTP_requests
<<In GET requests sensitive data should be transferred in an HTTP Header>>
Jacques
