I was thinking about https and i wondered. How much is protected? Is the entire request encrypted? i suspect it isnt because how would the server know which domain to connect to? Is only the body encrypted? if i request http://joes-site.com/abc/file.ext could people see the file i am requesting?

I assume post data is encrypted with https, are cookies? What exactly isnt encrypted?


The entire session is encrypted, including the full request and headers such as cookies. Previous to Server Name Indication (RFC4366, section 3.1), this made it impossible to choose which vhost to send a request to with HTTPS, so servers using HTTPS had to dedicate an IP to each domain/vhost. The only thing an observer could see is the encapsulating protocol information (to/from IPs, ports, etc)

With SNI, the vhost is transmitted during the TLS negotiation. The vhost (but not the entire request.. just the hostname) will be visible at that point, but subsequent requests will be entirely encrypted.

|improve this answer|||||
  • 3
    +1 Though it also bears mentioning (particularly if one is asking in the interest of maintaining privacy on an untrusted network) that DNS is a separate service and, by default, DNS lookups are sent "in the clear" – danlefree Jan 16 '11 at 5:57

The source and destination IPs are not encrypted. So if you are worried about snooping, someone will know that communication is taking place between two endpoints. They won't know precisely what was requested, or be able to see any of the information transmitted.

But all of this assumes that the client actually is talking to the server, and not any host in the middle. HTTPs heavily relies on a set of trusted certificate authorities. If a CA is compromised, or a false CA certificate is installed on the client system then an attacker can forge certificates, and intercept communication.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy