A sign-in form puts the password in the URL
A form on this page collects a password and submits it to the address it names with `method="get"`, which puts the password into the query string of the resulting URL.
Why it matters
A form on this page collects a password and submits it to the address it names with `method="get"`, which puts the password into the query string of the resulting URL. It is still encrypted in transit, so this is not an interception problem — it is a problem of where the password then gets written down. URLs are recorded everywhere by default. The password lands in your server's access logs and any proxy or CDN logs in front of them, in the visitor's browser history where anyone using that computer can read it, in bookmarks and shared links, and in the `Referer` header the browser sends to every third party whose script or image the next page loads — analytics and ad networks included. Change the form to `method="post"`. The server route has to accept POST for the same path, so change both together, and afterwards treat every password that has already passed through this form as compromised: purge the logs that captured them and require a reset.
How ShipReady detects it
How a form carrying a password submits it. PAGE-scoped, because a sign-in form lives on one route and the crawl reaches it separately from the homepage. Every finding's merge_key is the submission endpoint, so one login form reachable from ten pages is one finding.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A form that collects a password submits with `method="get"`, which puts the password in the URL. It is encrypted in transit, so this is not an interception bug — it is a bug about everywhere URLs get written down. CHANGE THE FORM TO `method="post"` and update the server route to accept POST for that path. Both halves have to change together or the form breaks. If the route is a framework handler, check that it is not registered as a GET-only route. THEN CLEAN UP WHAT ALREADY LEAKED, because the password has been recorded in several places by default: • your application and web-server access logs, plus any proxy or CDN logs in front of them; • the visitor's browser history, where anyone with access to that computer can read it; • the `Referer` header the browser sends to every third-party script, image or font the next page loads — which usually means an analytics provider now holds it. Purge or rotate those logs, and require a password reset for every account that has signed in through this form. Setting `Referrer-Policy: strict-origin-when-cross-origin` limits the third-party leak going forward, but it does not undo what has already been sent. GENERALLY: nothing secret belongs in a URL — not passwords, not API keys, not session tokens, not password-reset codes. If any of those appear in a query string anywhere in the app, move them into a POST body or a header for the same reasons.
Frequently asked questions
- What does "A sign-in form puts the password in the URL" mean?
- A form on this page collects a password and submits it to the address it names with `method="get"`, which puts the password into the query string of the resulting URL.
- How serious is it?
- ShipReady rates this high. Fix before launch. A real weakness that an attacker can act on.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.