Transmit all authentication credentials and tokens in HTTP headers, not URL query parameters:

• Use Authorization: Bearer <token> for API authentication

• Use HttpOnly, Secure, SameSite=Strict cookies for session management

• Never pass tokens, API keys, or session IDs in URL paths or query strings

Also review your logging configuration: ensure your access logs redact Authorization headers (avoid logging tokens) while still capturing necessary audit information.

• Server access logs — full URL logged for every request, stored for months

• Browser history — URL saved locally and synced across devices

• Referrer headers — full URL sent to any third-party resource on the next page

• CDN and proxy logs — caching infrastructure logs full URLs

• Shared screens and screenshots — URL bar visible, token visible

Single-use, short-lived email verification links (e.g., password reset links) legitimately need tokens in the URL because email clients can't add HTTP headers. These tokens must expire quickly (under 15 minutes) and be single-use.