A recent penetration test of some API code showed that user information (such as an email address) was being displayed in the querystring. The API was: [HttpPost] [Route("api/MyAPIEndPoint")] public void DoSomething(string login, string email) { // stuff } A simple view of the endpoint with a browser would display the users details. The network tab in Chrome showed "api/MyAPIEndPoint?login=X12345&email=test@test.com". A new approach was required. The solution is to include the data in the body of the Request. The factory event is updated as follows: function DoSomething(login, email, success, failure) { var url = "/api/MyAPIEndPoint"; var parameter = { "Login": login, "Email": email }; return executePost(url, parameter, success, failure); } function executePost(url, parameters, success, failure) { var req = { method: 'POST', url: url, data: parameters }; $htt...