An API key is included in the URL: GET /api/data?api_key=abc123. Why is this a security anti-pattern?

• A.URL parameters are sent in plaintext even over HTTPS, since the query string is visible to the TLS terminator (a CDN or load balancer), and the key is exposed to the provider. Keys should be sent in the request body, which keeps them out of path-based filters and WAF rules
• B.URL parameters appear in server access logs, browser history, Referer headers, and CDN logs - the API key is logged everywhere. Keys should be sent in headers (Authorization or X-API-Key) which are less likely to be logged by intermediaries
• C.URL parameters bypass the authentication middleware (a route filter that reads headers), and the key goes unvalidated by the gateway. Keys should be sent in cookies, which are checked before the router and the rate limiter see the incoming request
• D.URL parameters are cached forever by browsers (a persistent HTTP cache entry), and the key stays valid after rotation. Keys should be sent in a signed JWT claim, which expires automatically after the first use by the mobile client application