[yashafromrussia]

What kind of API design is this? Post data should be sent within the request's body over HTTPS. Not as a url query.

[mrcarrot]

Nowhere in the article does it say that the POST data was in the URL. As I understood it, he was editing the request body before the request was sent to PayPal's server.

[continuational]

The URL is encrypted too, so what's the difference in terms of security?

[ComodoHacker]

Does it matter in this case?