Good point. I think it hasn't been issue so far since it's an admin only call but its better to make this POST. But, I am not sure about other commands like addVPNUser which are authorized for all the accounts. Are they also GET?
-----Original Message----- From: Koushik Das [mailto:[email protected]] Sent: Friday, July 20, 2012 2:36 AM To: [email protected] Subject: MS UI - addHost call is a GET and the password of the host goes as cleartext The request URL may get logged in Tomcat and that may lead to security issues. Any call having such data should be a POST. Thanks, Koushik
