As a general note, GET and POST requests expose their parameters with equal visibility. It's just that the browser makes it more obvious what your GET parameters are