Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was thinking about https and i wondered. How much is protected? Is the entire request encrypted? i suspect it isnt because how would the server know which domain to connect to? Is only the body encrypted? if i request http://joes-site.com/abc/file.ext could people see the file i am requesting?

I assume post data is encrypted with https, are cookies? What exactly isnt encrypted?

share|improve this question
add comment

2 Answers

up vote 11 down vote accepted

The entire session is encrypted, including the full request and headers such as cookies. Previous to Server Name Indication (RFC4366, section 3.1), this made it impossible to choose which vhost to send a request to with HTTPS, so servers using HTTPS had to dedicate an IP to each domain/vhost. The only thing an observer could see is the encapsulating protocol information (to/from IPs, ports, etc)

With SNI, the vhost is transmitted during the TLS negotiation. The vhost (but not the entire request.. just the hostname) will be visible at that point, but subsequent requests will be entirely encrypted.

share|improve this answer
2  
+1 Though it also bears mentioning (particularly if one is asking in the interest of maintaining privacy on an untrusted network) that DNS is a separate service and, by default, DNS lookups are sent "in the clear" –  danlefree Jan 16 '11 at 5:57
add comment

The source and destination IPs are not encrypted. So if you are worried about snooping, someone will know that communication is taking place between two endpoints. They won't know precisely what was requested, or be able to see any of the information transmitted.

But all of this assumes that the client actually is talking to the server, and not any host in the middle. HTTPs heavily relies on a set of trusted certificate authorities. If a CA is compromised, or a false CA certificate is installed on the client system then an attacker can forge certificates, and intercept communication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.