Forwarding, by definition, is GET, you cannot redirect 301 or 302 using POST. If you are trying to prevent the user from seeing the value, you can save that value in the session and then retrieve it after the redirect. Although I already in the past tried to protect something, not allowing users to see that this is not the best approach (security through obscurity). You must take other measures to protect users from actions that they should not do, even if they know the meaning.
Even if I'm wrong, and you can redirect using POST, then the value should be part of the redirection, and therefore the user has a chance to find out about this if they use something to track HTTP traffic.
source
share