0

First a little context as a lot of people have been confused by my question in the past.

Everything in the 2 requests below is visible to a third party (man in the middle attack), url, data, host name, both ip addressed, etc.

POST

http://foo.com/

POST Data {
  foo: me,
  bar: you  
}

GET

http://foo.com?foo=me&bar=you

I belive only host name and both ip addresses are visable to the third party with the POST request below.

https://foo.com
POST Data {
  foo: me,
  bar: you
}

My question, is the same viable or is the GET data also visible compared to the POST request over https with this one?

https://foo.com?foo=me&bar=you
  • Someone answered my question yesterday with the perfect answer. I accepted said answer. But today the accepted answer has gone. Was that op deleting the answer or who ever it was removed their answer. In any case, why? – Chris Nov 12 '15 at 12:35
  • 1
    I don't know who removed the answer but the answer was wrong. Maybe the author itself removed it after I pointed out with a comment what was wrong with it. – Steffen Ullrich Nov 12 '15 at 13:27
  • Ok then, so the data in the GET request is definitely not visible over HTTPS. Thanks. – Chris Nov 13 '15 at 15:20
2

First, this kind of question is better asked at security.se. It was asked there several times and has extensive answers. See for example https://security.stackexchange.com/questions/12531/ssl-with-get-and-post.

In short: HTTPS is just HTTP inside a TLS tunnel. This means that both HTTP request and HTTP response are protected by TLS and thus the parameter are encrypted for GET and for POST requests. But there are several reasons why you should use POST anyway, like data from GET leaking into HTTP referer, log files etc.

  • There are far too many different exchanges now to figure out which one a question belongs to, do I put it here as it's part of the HTTP standard, do I put it in programming cause I'm talking about a REST request, do I put it in encryption cause it's an encrypted transfer of data, or like you said, security (which I didn't know existed and didn't see yesterday) Thanks for the answer, but you failed to see the question. The question was is the just the host or the whole URL visible to a third party with a GET request over HTTPS, not what is HTTPS and how does it work. – Chris Nov 12 '15 at 12:39
  • @Chris: I explained a bit how HTTPS works so that you can understand why the parameter of a GET request are not visible. And if I unserstand the help correctly then asking anything technical about HTTP is definitely off-topic here. – Steffen Ullrich Nov 12 '15 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.