Yeah, in the recent versions of TLS it does encrypt it fully. However, DNS might leak it since encrypted DNS resolution isn't that much of a standard yet. And browsers will still save the token in browser history.

If it's overkill to encrypt it properly, maybe, but it's an additional protection against 3rd party attacks, since no one can just take the token (from a browser) and send it without the shared secret.

https://stackoverflow.com/questions/499591/are-https-urls-encrypted

So no, it's not a security risk or a lower security to do it that way in this context

Thanks, I had hoped for something properly secure, but it will do.

Passing security tokens in the URL also means that it would be stored in customers bookmarks and the ISP and DNS provider will have access to the token.

https://support.appdrag.site/blog/84-Create-integrated-custom-dashboard---admin-interfaces.html?category=15

Thanks, appreciated.

I think the safest way to do it is like I described in the other thread.

I'm assuming, via custom admin button (Configure left menu).

A while back (old chat) you mentioned that when using custom menu, that the current user tokens are submitted to the URL? I asked for docs but never heard back.