[maratd]

> But it would be nice at the very least if they'd send it as POSTs in the body, not GET parameters.

If the GET is being sent via XHR over SSL, how is doing a POST any more secure?

[brandonl222]

The general argument here is server logs. You'll see the entire url show up for GET. By using a POST and actually putting the data in the post body you won't see it show up in logging.

[camel_Snake]

My guess is simple things like the url showing up in server logs etc.