will IIS keep track of the parameters sent to a post action method

Question

I have the following Post action method which accept username & password, connect to Active Directory and get the user info in JSON format after validating the credentials:

[HttpPost]  
public ActionResult UserInfo(string username, string password)  
{  

now since this is a POSt action method, will IIS logs keep track of the entered parameters? in this case the username and password? If the answer is yes, then how i can secure those parameters? Thanks

Answer 1

Hi @john john

First of all, we need to know that the content displayed in the URL will be recorded by IIS Log.

As we know, Post requests can hide parameters, but the parameter information needs to be placed in the body. From a coding perspective, attributes such as [FromForm] or [FromBody] are required.

From Postman, it will be more intuitive. The parameters in area 1 will be added directly to the URL, that is, they will be recorded. In the body of zone 2, it will not be recorded.

---

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards,
Jason

Answer 2

by default, IIS does not log body data, only the url.