Passing credit card values via GET over SSL

is this secure?

[ryan_b83]

Hello sorry if this is in the wrong section, but im using php to send credit card information. A gateway company requires me to send them the variables for a credit card transaction over SSL but using the GET variable and not POST. I always thought GET's were not secure and the URL could be read by "man in the middle's"? Is this not true?

Thanks,
Ryan

[physics]

As far as I know GET is not intrinsically less secure in this sort of circumstance. The POST data is being sent as text also (or maybe little POST fairies transport it through hyperspace .. just funning). As far as I know, as long as the transmission pathway is encrypted via SSL both would be secure.
GET gets a bad rap because sometimes designers will use it in ways that cause pages to get bookmarked that shouldn't get bookmarked (and it's definitely true that in your web app the user's login url should not show up like login.php?uname=bob&password=mycat, but that's just because now the user might post that url to delicious or something and thus the whole world would know their login), etc.

From the authoritative source:
URIs, Addressability, and the use of HTTP GET and POST [w3.org]

4 Considerations for Sensitive Data

Some Web interactions involve sensitive data, such as passwords, credit card numbers, social security numbers, and bank account numbers (as in scenario 2).

To protect information carried by either GET or POST operations, it is often appropriate to use an underlying secure protocol such as the Secure Socket Layer [SSL3]. By using GET over SSL for safe operations, designers retain some of the benefits of URI addressability, even if they lose others (e.g., caching). Designers do need to consider the costs of using SSL, such as:

[ryan_b83]

great post! that answers my question thanx alot!

[jatar_k]

another thing that comes into play is that if you use GET for your site then sensitive data may show up in your server logs. If this is the case then you must also be sure that those logs are always properly secured as well.

[coopster]

Excellent reminder, jatar_k. Some of todays 'web site control panels' have made it so easy to leave that door open. Protect your server logs like you would a password. Sometimes it is the password. Don't forget that.