Can URL used inside an HTTPS session be read by HTTP proxy ?

PlatinumX · 07-30-2008, 03:36 AM

Hi all,

The title says all

When I connect a web server, for exemple https://www.mybanq.com, I open an SSL session.

After that, are the URL I am requestong on the web server of my banq part of the ciphered data ?
For exemple, when I see: https://www.mybanq.com?id=bar&pass=foo
are the information id=bar&pass=foo sent in plain text over the net (and sniffer and web proxy) or it is ciphered ?

Thanks

win32sux · 07-30-2008, 04:32 AM

Quote:

Originally Posted by PlatinumX

When I connect a web server, for exemple https://www.mybanq.com, I open an SSL session.

After that, are the URL I am requestong on the web server of my banq part of the ciphered data ?
For exemple, when I see: https://www.mybanq.com?id=bar&pass=foo
are the information id=bar&pass=foo sent in plain text over the net (and sniffer and web proxy) or it is ciphered ?

No, using HTTPS doesn't on its own offer your URLs any sort of eavesdropping protection.

That said, I'm closing this thread, as it's essentially the same as this one.