Is it a security issue to include postcode and/or last name in a GET request query string?
I'm currently designing an API endpoint to validate a customer, and they can either pass in their postcode or their last name, as well as their customer ID (plus some other irrelevant data).
I've heard that including PII or sensitive data in the query string can be a security risk. I can't find a whole lot of information on this, apart from not including obvious things like passwords.
This endpoint uses one query string parameter for both the postcode or last name (obviously not ideal but it's a limitation). If someone got access to the server logs, is it possible to correlate multiple requests from one user, which could result in that person being identified by combining their postcode and last name? This would be possible from looking at their browser history at least so that may be an issue.
And would it be preferable to do this validation as a POST request? I'm not sure at what point it becomes a security risk and what kind of data is safe to include in the query string, and at what point data becomes personally identifying or if that's really an issue.
Looking at popular APIs like Stripe and Shopify, it seems they do customer searches with a query string, but Salesforce does it with a POST, so not really sure which is the way to go.
