Post #3643653

@simonbs@mastodon.social it's fine for it to be an identifier, but usually combined with an authorization header (or pre-shared secret) it's not that systems _can_ log headers too, it's that URLs are very commonly logged in their entirety. There's a general assumption that the url is fine to be logged. Query string would help in this regard, but I still think auth header is the better approach. I think what you suggest would work well. Existing users wouldn't have to change anything, but people could choose.