I'm trying to create a page that contains a list of unfiltered results and a search bar that lets users type a search term and hit enter, and then see a (server-side) filtered set of results.

This would be very easy if I could include the search term in the URL as a query parameter, but unfortunately the search terms are sensitive data and so I cannot include them in the URL, as described in this OWASP vulnerability: https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url.

Is there a good pattern for doing this? Ideally I'd still like to load the unfiltered results on first page load, and it would be great if the search term could survive page refresh. I thought about using the browser's location.state to store the search term, but I understand that's not supported in NextJS. Is there a better alternative?

Thanks!