Login to salesforce by REST API get method

Question

I am referring a document from salesforce help at https://help.salesforce.com/articleView?id=users_login_history.htm&type=5 which reads below-

View the HTTP method used for the session login: POST, GET, or Unknown. You can use this information to determine if a user is inadvertently exposing user credentials through a GET request. For example, if a user entered a username and password on the login page, the HTTP method for login is a secure POST request. However, if the user logged in by providing the username and password in the URL as a GET request, the credentials are exposed. From Setup, enter Login History in the Quick Find box, then select Login History and view the HTTP Method column.

1. Are we allowed to login to salesforce using REST Get? I don't find any Get approach, only thing I could find is Post. If such method exist then can any one provide documentation link or any further information.
2. Even if such a get method exist then (and I missed it to find) then why salesforce has such thing at very first place. Isn't it like designing a trap and then monitor who all fall into that trap?

Answer 1

Are we allowed to login to salesforce using REST Get? I don't find any Get approach, only thing I could find is Post. If such method exist then can any one provide documentation link or any further information.

Yes, you can login with the following URL pattern:

https://login.salesforce.com/?un=encoded-username%40domain.tld&pw=ExposedPassword

I don't believe this is in the documentation, and certainly people should avoid using this in favor of actual secure login methods, such as the Lightning Authenticator, etc.

Even if such a get method exist then (and I missed it to find) then why salesforce has such thing at very first place. Isn't it like designing a trap and then monitor who all fall into that trap?

Actually, the trap was set by either HTTP or HTML, take your pick. The form tag allows two methods, "GET" and "POST." In order to be compliant with the standards, HTTP allows query strings and application/x-www-form-url-encoded. Salesforce is simply complying with the standards. This is all ancient history, but as with most web technology, we are burdened by the mistakes of the 80s and 90s, that we can't just remove because it could break untold number of services, apps, etc.

By monitoring the situation, administrators can tell their users to change their behaviors. This is the best that can be reasonably expected given the historical context.