I need a way to hide the parameters in the URL, like Microsoft's SSRS uses an internal parameter that isn't passed in the URL.

Internal parameters are ideal for anchoring global variables (like UserID) within the report logic to filter data securely. Because the parameter is internal, a user cannot manipulate the URL to spoof another user's ID and view restricted data.