Try typing in place of a URL and pressing Enter . This information is also kept on your disk, in a file named history.txt . Cookies are not secret any more either. When designing a system, build in an Exit button that will delete any cookies you may have set which contain authentication information. Javascript also allow you to see any cookies for your current path.
Most data is sent to servers using either a GET or POST methods.
Most servers also support the PUT method. Using this method, a user could overlay an existing page on your server with one of their own. Lets say the page in question is a page which asks the user to authenticate themselves. The prevention, is to strictly limit access to the PUT method or disallow it all together. If the CGI does not escape delimiter characters, a user could gain access to information which you did not intent or worse destroy information on your server.