Web Security · Middle · Question 30 of 75

Why should CSRF tokens not be put in URLs (for example `?csrf=...`)?

1Because the token would be too long
2Because URLs can't contain random characters
✓Correct answer: URLs leak through logs, browser history and the Referer header

Explanation

Keep tokens in hidden form fields or custom headers, where they don't end up in server logs or third-party referrers.

Further reading

OWASP: CSRF Prevention Cheat Sheet ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.