Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This might be a theoretical question but if I were to request the following url:

https://example.com?username=username&password=password

Would the username and password be stored on the dns server causing a problem if the dns server is compromised?

Is the handshake and secure tunnel created before any data is sent?

share|improve this question
    
IMHO, please don't do this in an actual representation as the browser would cache this URL in its history. –  Nathan C Aug 14 '13 at 11:31

3 Answers 3

When you try to connect to https://example.com/?username=username&password=password, only the example.com is resolved via DNS (nothing else is sent to the DNS server).

After that (since it's http*s*), an SSL handshake will be made with the server (key exchange, etc.), and only after that, the request (eg. GET /?username=username&password=password) will be sent over an encrypted channel.

share|improve this answer

The DNS lookup takes place before the HTTPS connection, but only the domain is looked up. In your example, all the DNS server would know is that someone looked up the address for example.com. It wouldn't even know that a browser was involved.

The encrypted connection is indeed created before any data is sent; this includes the Host: HTTP header which tells the server the domain part of the URL. This is important because many websites can be presented on a single IP address, and the webserver has no way of knowing which was requested before SSL negotiation takes place. Modern browsers implement SNI, which sends the domain name (and only the domain name) outside of the encrypted connection.

The quote you've included in your own answer is almost right: an attacker can see the far end's IP address, but can't know the domain name for certain unless SNI is in use.

share|improve this answer

Found the answer I was looking for just after posting at HTTP Secure.

Everything in the HTTPS message is encrypted, including the headers, and the
request/response load. With the exception of the possible CCA cryptographic
attack described in the limitations section below, the attacker can only know
the fact that a connection is taking place between the two parties, already
known to him, the domain name and IP addresses.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.