Should sensitive data ever be passed via the query string as opposed to the POST request?   I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the query string, such as shoulder surfing?
If the query string is the target of a user-clickable link (as opposed to a URL used from some Javascript), then it will appear in the URL bar of the browser when the corresponding page is loaded. It has the following issues:


The URL will be displayed. Shoulder surfers may see it and learn things from that (e.g. a password).
The user may bookmark it. This can be a feature; but it also means that the data gets written on the disk.
Similarly, the URL will make it to the "history" so it will be written to disk anyway; and it might be retrieved afterwards. For instance, if the browser is Chrome, then a lunch-time attacker just has to type Ctrl+H to open the "history tab" and obtain all the query strings.
If page is printed, the URL will be printed, including any sensitive information.
URLs including query strings are also frequently logged on the web server, and those logs may not be secured appropriately.
There are size limitations on the query string, which depend on the browser and the server (there is nothing really standard here, but expect trouble beyond about 4 kB).


Therefore, if the query string is a simple link target in an HTML page, then sensitive data should be transmitted as part of a POST form, not encoded in the URL itself. With programmatic downloads (the AJAX way), this is much less of an issue.
