URL query is insecure

[r3m0t]

Hi, instead of using the ? query in the URL, it would be more secure to use the # fragment, as this is not sent to the server hosting the encrypted page.

[quinncomendant]

I just came here to suggest this. Using URL query params causes the secret key to be saved to server access logs.

Better to use the key with a hash mark, e.g.:

example_encrypted.html#b91643e123aad6c3565f273a71bf752231c0704342f81438d8a2e964442dbb47

[robinmoisson]

This is a great idea, thank you for the suggestion!

[robinmoisson]

Done & released, we also use fragments for logout, that way nothing staticrypt related is ever sent to the server. Thanks for the suggestion!