Performing GET with secure data

You shouldnt full stop! Even if the GET is performed over HTTPS, the complete GET URL with associated query string parameters are logged by the web server (in my case IIS logs) but would assume that Apache and other popular/capable web servers would do the same! Any web intermediaries would also log the data.

If you need to get secure data passed from the browser where the current domain is HTTPS to a different HTTPS domain you cannot perform the following:
1. Perform a POST (see previous post)
2. Perform a GET (cant as web servers log the data - not advised)

So what is the solution?
Really, the only solution is to perform a server to server call. Rather than calling direct from the browser, pass the secure data to the website/applications associated web server and perform a server to server call from there!

Posting across secure domains

Came across this issue in the last few days. If your browser is at https://securedomain1/... and you need to POST to https://securedomain2/..., you cannot trust this as IE and FF browsers later versions (and I would assume Opera + other browsers also) detect this and notify the user who is given the option to manually move on or not!

This is just a point of note. Usually one should aspire to design a web application where posting from one secure domain to another does not occur. Typically in an e-business website, the payment detail page will be secure and often hosted by a third party. Hence the rest of the website is non-secure as it is not required. You don't want your website to be over HTTPS and then having to redirect to a third party in a different secure domain over HTTPS.