title: How to secure REST GET method?
body: <p>HTTP GET method will transfer data over the url as in <code>https://www.example.com/users?id=1</code>. If I use HTTPS the connection will be secure but the sensitive data in the link could still be logged on the server uppon processing the link requested by the client, exposing secrets to be acquired by some hacker later.</p>
  
  <p><a href="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet" rel="nofollow noreferrer">OWASP recommends</a> not storing anything on the links, as it can be logged on the web server.</p>
  
  <p>But REST uses GET to retrieve data, as a "Read" would in a <code>CRUD</code> operation.</p>
  
  <p>So the question is, <strong>How can I make a secure GET call on REST?</strong></p>
  
  <hr>
  
  <p>EDIT: One example: OWASP says to NOT include an API Key on the URL address, but since all data sent on a GET request is placed on the URL, <strong>how would I send the API Key to the server in other to authorize the GET response from that user, since I can't place it on the URL itself?</strong> </p>
  
  <p>OWASP doesn't explain how to achieve this.</p>