diff --git a/net/http/inc/THttpCallArg.h b/net/http/inc/THttpCallArg.h
index 9d6ebcc340339c6680c2ddca43dd267f1dd0a635..9c48eefff58c781d77b2fe024b066090403ee7e2 100644
--- a/net/http/inc/THttpCallArg.h
+++ b/net/http/inc/THttpCallArg.h
@@ -35,10 +35,7 @@ protected:
    TString fUserName; ///<! authenticated user name (if any)
    TString fQuery;    ///<! additional arguments
 
-   void *fPostData;        ///<! binary data received with post request
-   Long_t fPostDataLength; ///<! length of binary data
-
-   UInt_t fWSId; ///<! websocket identifier, used in web-socket related operations
+   UInt_t fWSId{0}; ///<! websocket identifier, used in web-socket related operations
 
    std::condition_variable fCond; ///<! condition used to wait for processing
 
@@ -46,12 +43,12 @@ protected:
    TString fRequestHeader; ///<! complete header, provided with request
    TString fHeader;        ///<! response header like ContentEncoding, Cache-Control and so on
    TString fContent;       ///<! text content (if any)
-   Int_t fZipping;         ///<! indicate if content should be zipped
+   Int_t fZipping{0};      ///<! indicate if content should be zipped
 
-   void *fBinData;        ///<! binary data, assigned with http call
-   Long_t fBinDataLength; ///<! length of binary data
+   void *fBinData{nullptr};        ///<! binary data, assigned with http call
+   Long_t fBinDataLength{0}; ///<! length of binary data
 
-   Bool_t fNotifyFlag; ///<!  indicate that notification called
+   Bool_t fNotifyFlag{kFALSE}; ///<!  indicate that notification called
 
    Bool_t IsBinData() const { return fBinData && fBinDataLength > 0; }
 
@@ -60,13 +57,15 @@ protected:
    TString CountHeader(const TString &buf, Int_t number = -1111) const;
 
 private:
-   THttpWSEngine *fWSEngine; ///<!  web-socket engine, which helps to run it
+   THttpWSEngine *fWSEngine{nullptr}; ///<!  web-socket engine, which helps to run it
+
+   std::string  fPostData; ///<! data received with post request - binary or text
 
    void SetWSEngine(THttpWSEngine *);
    THttpWSEngine *TakeWSEngine();
 
 public:
-   THttpCallArg();
+   explicit THttpCallArg() = default;
    virtual ~THttpCallArg();
 
    // these methods used to set http request arguments
@@ -93,6 +92,8 @@ public:
 
    void SetPostData(void *data, Long_t length, Bool_t make_copy = kFALSE);
 
+   void SetPostData(std::string &data);
+
    /** set web-socket id */
    void SetWSId(UInt_t id) { fWSId = id; }
 
@@ -124,13 +125,13 @@ public:
    Bool_t IsPostMethod() const { return IsMethod("POST"); }
 
    /** return pointer on posted with request data */
-   void *GetPostData() const { return fPostData; }
+   const void *GetPostData() const { return fPostData.data(); }
 
    /** return length of posted with request data */
-   Long_t GetPostDataLength() const { return fPostDataLength; }
+   Long_t GetPostDataLength() const { return (Long_t) fPostData.length(); }
 
    /** returns post data as TString */
-   TString GetPostDataAsString() const { return TString((const char *)GetPostData(), GetPostDataLength()); }
+   TString GetPostDataAsString() const { return TString(fPostData.c_str()); }
 
    /** returns path name from request URL */
    const char *GetPathName() const { return fPathName.Data(); }
diff --git a/net/http/src/TCivetweb.cxx b/net/http/src/TCivetweb.cxx
index fae0932e2d78b65d638fba8c4a9daabdc1cb7d5c..45fed3f2e8fe72945d4f53eaea83124aec9a0c78 100644
--- a/net/http/src/TCivetweb.cxx
+++ b/net/http/src/TCivetweb.cxx
@@ -145,7 +145,8 @@ int websocket_data_handler(struct mg_connection *conn, int, char *data, size_t l
    arg->SetWSId(TString::Hash((void *)&conn, sizeof(void *)));
    arg->SetMethod("WS_DATA");
 
-   arg->SetPostData(data, len, kTRUE); // make copy of original data
+   std::string str(data, len);
+   arg->SetPostData(str);
 
    serv->ExecuteHttp(arg);
 
@@ -244,12 +245,11 @@ static int begin_request_handler(struct mg_connection *conn, void *)
       Int_t ilen = len ? TString(len).Atoi() : 0;
 
       if (ilen > 0) {
-         void *buf = malloc(ilen + 1); // one byte more for null-termination
-         Int_t iread = mg_read(conn, buf, ilen);
+         std::string buf;
+         buf.resize(ilen);
+         Int_t iread = mg_read(conn, (void *) buf.data(), ilen);
          if (iread == ilen)
-            arg->SetPostData(buf, ilen);
-         else
-            free(buf);
+            arg->SetPostData(buf);
       }
 
       if (debug) {
diff --git a/net/http/src/TFastCgi.cxx b/net/http/src/TFastCgi.cxx
index 6367438bc1c0fd822e9f9d2eb69e822af77d8f11..e25b358a9b84fb3c0c6247e86ada1dc9957ca2ec 100644
--- a/net/http/src/TFastCgi.cxx
+++ b/net/http/src/TFastCgi.cxx
@@ -214,12 +214,11 @@ void *TFastCgi::run_func(void *args)
       if (inp_length != 0)
          len = strtol(inp_length, NULL, 10);
       if (len > 0) {
-         void *buf = malloc(len + 1); // one byte more for null-termination
-         int nread = FCGX_GetStr((char *)buf, len, request.in);
-         if (nread > 0)
-            arg->SetPostData(buf, nread);
-         else
-            free(buf);
+         std::string buf;
+         buf.resize(len);
+         int nread = FCGX_GetStr((char *)buf.data(), len, request.in);
+         if (nread == len)
+            arg->SetPostData(buf);
       }
 
       TString header;
diff --git a/net/http/src/THttpCallArg.cxx b/net/http/src/THttpCallArg.cxx
index c10370ad25b2210478f29c06761df38169785370..da4c3b0e5ed7a4afe9d2241e87954ee59974e0cd 100644
--- a/net/http/src/THttpCallArg.cxx
+++ b/net/http/src/THttpCallArg.cxx
@@ -26,26 +26,11 @@
 
 ClassImp(THttpCallArg);
 
-////////////////////////////////////////////////////////////////////////////////
-/// constructor
-
-THttpCallArg::THttpCallArg()
-   : TObject(), fTopName(), fMethod(), fPathName(), fFileName(), fUserName(), fQuery(), fPostData(nullptr),
-     fPostDataLength(0), fWSId(0), fContentType(), fRequestHeader(), fHeader(), fContent(), fZipping(0),
-     fBinData(nullptr), fBinDataLength(0), fNotifyFlag(kFALSE), fWSEngine(nullptr)
-{
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 /// destructor
 
 THttpCallArg::~THttpCallArg()
 {
-   if (fPostData) {
-      free(fPostData);
-      fPostData = nullptr;
-   }
-
    if (fWSEngine) {
       delete fWSEngine;
       fWSEngine = nullptr;
@@ -141,6 +126,7 @@ TString THttpCallArg::CountHeader(const TString &buf, Int_t number) const
 }
 
 ////////////////////////////////////////////////////////////////////////////////
+/// \deprecated  Use signature with std::string
 /// set data, posted with the request
 /// buffer should be allocated with malloc(length+1) call,
 /// while last byte will be set to 0
@@ -148,26 +134,22 @@ TString THttpCallArg::CountHeader(const TString &buf, Int_t number) const
 
 void THttpCallArg::SetPostData(void *data, Long_t length, Bool_t make_copy)
 {
-   if (fPostData) {
-      free(fPostData);
-      fPostData = nullptr;
-      fPostDataLength = 0;
-   }
-
-   if (length <= 0)
-      return;
+   fPostData.resize(length);
 
-   if (make_copy && data && length) {
-      void *newdata = malloc(length + 1);
-      memcpy(newdata, data, length);
-      data = newdata;
+   if (data && length) {
+      memcpy((void *) fPostData.data(), data, length);
+      if (!make_copy) free(data); // it supposed to get ownership over the buffer
    }
+}
 
-   if (data)
-      *(((char *)data) + length) = 0;
+////////////////////////////////////////////////////////////////////////////////
+/// set data, which is posted with the request
+/// Although std::string is used, not only text data can be assigned -
+/// std::string can contain any sequence of symbols
 
-   fPostData = data;
-   fPostDataLength = length;
+void THttpCallArg::SetPostData(std::string &data)
+{
+   fPostData = std::move(data);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/net/http/src/THttpServer.cxx b/net/http/src/THttpServer.cxx
index 8b68bf83e5449dd5650eb9b30bed4b2f23dd6816..26e8627131bca89558bc70599397026350773503 100644
--- a/net/http/src/THttpServer.cxx
+++ b/net/http/src/THttpServer.cxx
@@ -768,12 +768,11 @@ void THttpServer::ProcessRequest(std::shared_ptr<THttpCallArg> arg)
                // posted data transferred as URL parameter
                // done due to limitation of webengine in qt
                Int_t len = strlen(post);
-               void *buf = malloc(len / 2 + 1);
-               char *sbuf = (char *)buf;
+               std::string buf;
+               buf.resize(len/2);
                for (int n = 0; n < len; n += 2)
-                  sbuf[n / 2] = TString::BaseConvert(TString(post + n, 2), 16, 10).Atoi();
-               sbuf[len / 2] = 0; // just in case of zero-terminated string
-               arg->SetPostData(buf, len / 2);
+                  buf[n / 2] = TString::BaseConvert(TString(post + n, 2), 16, 10).Atoi();
+               arg->SetPostData(buf);
             }
          }
 
diff --git a/net/httpsniff/src/TRootSnifferFull.cxx b/net/httpsniff/src/TRootSnifferFull.cxx
index 8291ce179cc83e88f116c470c6c222787e175ffa..dc3a346d0ce4cdd74ac280896d1ff019e07208b8 100644
--- a/net/httpsniff/src/TRootSnifferFull.cxx
+++ b/net/httpsniff/src/TRootSnifferFull.cxx
@@ -618,7 +618,7 @@ Bool_t TRootSnifferFull::ProduceExe(const char *path, const char *options, Int_t
                } else {
                   if (debug)
                      debug->Append(TString::Format("Reconstruct object of class %s from POST data\n", clname.Data()));
-                  TBufferFile buf(TBuffer::kRead, fCurrentArg->GetPostDataLength(), fCurrentArg->GetPostData(), kFALSE);
+                  TBufferFile buf(TBuffer::kRead, fCurrentArg->GetPostDataLength(), (void *)fCurrentArg->GetPostData(), kFALSE);
                   buf.MapObject(post_obj, arg_cl);
                   post_obj->Streamer(buf);
                   if (url.HasOption("_destroy_post_"))