3

I was thinking about https and i wondered. How much is protected? Is the entire request encrypted? i suspect it isnt because how would the server know which domain to connect to? Is only the body encrypted? if i request http://joes-site.com/abc/file.ext could people see the file i am requesting?

I assume post data is encrypted with https, are cookies? What exactly isnt encrypted?

Improve this question

2 Answers 2

Reset to default
11

The entire session is encrypted, including the full request and headers such as cookies. Previous to Server Name Indication (RFC4366, section 3.1), this made it impossible to choose which vhost to send a request to with HTTPS, so servers using HTTPS had to dedicate an IP to each domain/vhost. The only thing an observer could see is the encapsulating protocol information (to/from IPs, ports, etc)

With SNI, the vhost is transmitted during the TLS negotiation. The vhost (but not the entire request.. just the hostname) will be visible at that point, but subsequent requests will be entirely encrypted.

Improve this answer
1
  • 3
    +1 Though it also bears mentioning (particularly if one is asking in the interest of maintaining privacy on an untrusted network) that DNS is a separate service and, by default, DNS lookups are sent "in the clear"
    – danlefree
    Jan 16, 2011 at 5:57
2

The source and destination IPs are not encrypted. So if you are worried about snooping, someone will know that communication is taking place between two endpoints. They won't know precisely what was requested, or be able to see any of the information transmitted.

But all of this assumes that the client actually is talking to the server, and not any host in the middle. HTTPs heavily relies on a set of trusted certificate authorities. If a CA is compromised, or a false CA certificate is installed on the client system then an attacker can forge certificates, and intercept communication.

Improve this answer

You must log in to answer this question.