I have 2 choices in sending data between 2 web applications.


I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.

For eg., http:/myDomain/someCode/pages/somePage.jsf?pin=MzAwMDY3MDI2OQ
Send the parameters as hidden values from application1 to application2.

String res=(String)request.getAttribute("paramValue");
document.myForm.action='myDestinationURL';
document.myForm.method="POST";
document.myForm.submit();

<form name="myForm" method="post">
<input type="hidden" name="paramValue" value="<%=res%>" />


In Choice 1, one can know the parameters that am sending and my Encoding technique. In choice 2, one can view the data that am sending by doing a view source easily.

Apart from above things, what possible ways exist for an intruder to know my system better? And which option is more suitable in general for a developer? Choice 1 or Choice 2?

Option 1 may introduce a number of non-security related issues anyway:


The resulting URL may be cached by the browser, or bookmarked, causing users to resubmit.
The resulting URL may be shared by users, causing third parties to submit.
The URL may be sent to your browser vendor, who may hit the site.


But this is about security, and it introduces a few risks not present in option 2:


The URL with its parameter may end up in the proxy logs of everything along the way, revealing your data.
Your decode function is now an additional attack vector. (Does it handle unicode correctly? Does it have length restrictions?)
You may be tempted to think of your encoded string as somehow secure, when it's just security through obscurity (and not very much obscurity), or perhaps more appropriately, security theatre.


That said though; they are otherwise largely equivalent in the security they offer. They both submit plain text data in the HTTP header, and base64 isn't exactly rocket science (and you can base64 encode your POST version). 

Neither offers any meaningful protection for your data.

If it's information you don't want the user to see; why are you sending it to the user to begin with? Consider the architecture you're using and see if there's a way to simply remove the risk entirely by not handling that information on the client side.

So, to answer the question: with regards to sending data - both reveal the same information to an attacker; choose whichever option is more appropriate for the situation (this Treehouse blog post may help with that), but you should not rely on either method to actually protect anything.
