Auth tokens are not passed in URL parameters

Auth tokens placed in URL query parameters (CWE-598, CWE-200) are automatically recorded in browser history, server access logs, proxy logs, and the HTTP Referer header sent to any third-party resource on the next page. A token that lives in a URL has already been logged somewhere beyond your control. OWASP A02 (Cryptographic Failures) covers sensitive data exposure through insecure transport, and OWASP ASVS V7 Session Management explicitly disallows placing session identifiers in URL query strings; a token visible in a URL is effectively broadcast to every system the request passes through.

Move every persistent auth token out of URLs and into request headers:

// Use the Authorization header, not a query string
const response = await fetch('/api/data', {
  headers: { Authorization: `Bearer ${token}` }
})

// Never do this:
const response = await fetch(`/api/data?token=${token}`)

For server-to-server calls, use an Authorization header or a dedicated custom header like X-API-Key. The only accepted exception is a one-time-use, short-lived token in an email link (password reset, email verification) — but even these should expire within 1 hour and be invalidated immediately on first use.