By Daniel Kivatinos


2009-01-31 21:15:34 8 Comments

Are all URLs encrypted when using TLS/SSL (HTTPS) encryption? I would like to know because I want all URL data to be hidden when using TLS/SSL (HTTPS).

If TLS/SSL gives you total URL encryption then I don't have to worry about hiding confidential information from URLs.

14 comments

@Nicolas Guérinet 2019-01-24 22:47:56

It is now 2019 and the TLS v1.3 has been released. According to Cloudflare, the server name indication (SNI aka the hostname) can be encrypted thanks to TLS v1.3. So, I told myself great! Let's see how it looks within the TCP packets of cloudflare.com So, I caught a "client hello" handshake packet from a response of the cloudflare server using Google Chrome as browser & wireshark as packet sniffer. I still can read the hostname in plain text within the Client hello packet as you can see below. It is not encrypted.

enter image description here

So, beware of what you can read because this is still not an anonymous connection. A middleware application between the client and the server could log every domain that are requested by a client.

So, it looks like the encryption of the SNI requires additional implementations to work along with TLSv1.3

UPDATE June 2020: It looks like the Encrypted SNI is initiated by the browser. Cloudflare has a page for you to check if your browser supports Encrypted SNI:

https://www.cloudflare.com/ssl/encrypted-sni/

At this point, I think Google chrome does not support it. You can activate Encrypted SNI in Firefox manually. When I tried it for some reason, it didn't work instantly. I restarted Firefox twice before it worked:

Type: about:config in the URL field.

Check if network.security.esni.enabled is true. Clear your cache / restart

Go to the website, I mentioned before.

As you can see VPN services are still useful today for people who want to ensure that a coffee shop owner does not log the list of websites that people visit.

@Piskvor left the building 2019-09-16 08:47:33

"the SNI can be encrypted" - that's the key point. Checking cloudflare.com/ssl/encrypted-sni with current Google Chrome says "Your browser did not encrypt the SNI when visiting this page." It takes two to tango...

@Piskvor left the building 2019-09-16 09:10:26

Apparently current Firefox can do ESNI, but it's disabled by default: you need to enable network.security.esni.enabled, set network.trr.mode to 2 (which currently sets your DoH resolver to CloudFlare), and restart the browser (sic!); then it will use ESNI - where supported by the domain's infrastructure. See blog.mozilla.org/security/2018/10/18/… for details.

@pedrorijo91 2020-04-05 13:37:25

While you already have very good answers, I really like the explanation on this website: https://https.cio.gov/faq/#what-information-does-https-protect

in short: using HTTPS hides:

  • HTTP method
  • query params
  • POST body (if present)
  • Request headers (cookies included)
  • Status code

@evilSnobu 2016-08-02 18:26:34

Since nobody provided a wire capture, here's one.
Server Name (the domain part of the URL) is presented in the ClientHello packet, in plain text.

The following shows a browser request to:
https://i.stack.imgur.com/path/?some=parameters&go=here

ClientHello SNI See this answer for more on TLS version fields (there are 3 of them - not versions, fields that each contain a version number!)

From https://www.ietf.org/rfc/rfc3546.txt:

3.1. Server Name Indication

[TLS] does not provide a mechanism for a client to tell a server the name of the server it is contacting. It may be desirable for clients to provide this information to facilitate secure connections to servers that host multiple 'virtual' servers at a single underlying network address.

In order to provide the server name, clients MAY include an extension of type "server_name" in the (extended) client hello.


In short:

  • FQDN (the domain part of the URL) MAY be transmitted in clear inside the ClientHello packet if SNI extension is used

  • The rest of the URL (/path/?some=parameters&go=here) has no business being inside ClientHello since the request URL is a HTTP thing (OSI Layer 7), therefore it will never show up in a TLS handshake (Layer 4 or 5). That will come later on in a GET /path/?some=parameters&go=here HTTP/1.1 HTTP request, AFTER the secure TLS channel is established.


EXECUTIVE SUMMARY

Domain name MAY be transmitted in clear (if SNI extension is used in the TLS handshake) but URL (path and parameters) is always encrypted.


MARCH 2019 UPDATE

Thank you carlin.scott for bringing this one up.

The payload in the SNI extension can now be encrypted via this draft RFC proposal. This capability only exists in TLS 1.3 (as an option and it's up to both ends to implement it) and there is no backwards compatibility with TLS 1.2 and below.

CloudFlare is doing it and you can read more about the internals here — If the chicken must come before the egg, where do you put the chicken?

In practice this means that instead of transmitting the FQDN in plain text (like the Wireshark capture shows), it is now encrypted.

NOTE: This addresses the privacy aspect more than the security one since a reverse DNS lookup MAY reveal the intended destination host anyway.

@oscaroscar 2018-04-18 14:04:23

Perfect answer, with complete explanation from A to Z. I love the Executive summary. Made my day @evilSnobu

@Jens Kreidler 2018-05-07 06:51:11

Perfect answer, upvote! Still consider the client part since the browser history may be a leak. However, regarding the transport layer, URL-parameters are encrypted.

@carlin.scott 2019-03-21 18:00:46

You may want to update this answer with the fact that TLS 1.3 encrypts the SNI extension, and the biggest CDN is doing just that: blog.cloudflare.com/encrypted-sni Of course a packet sniffer could just do a reverse-dns lookup for the IP addresses you're connecting to.

@Maksim Shamihulau 2019-11-11 14:47:29

@evilSnobu, but username:password part of username:[email protected] is encrypted, right? So it's secure to pass sensitive data in url using https.

@evilSnobu 2019-11-11 16:32:29

They are encrypted on the wire (in transport) but if either end (user or server) logs the URL to a plain text file and does not sanitize credentials... now that's a different conversation.

@Chris Rutledge 2018-08-22 08:03:38

Additionally, if you're building a ReSTful API, browser leakage and http referer issues are mostly mitigated as the client may not be a browser and you may not have people clicking links.

If this is the case I'd recommend oAuth2 login to obtain a bearer token. In which case the only sensitive data would be the initial credentials...which should probably be in a post request anyway

@Ricardo BRGWeb 2018-08-03 00:08:54

Althought there are some good answers already here, most of them are focusing in browser navigation. I'm writing this in 2018 and probably someone wants to know about the security of mobile apps.

For mobile apps, if you control both ends of the application (server and app), as long as you use HTTPS you're secure. iOS or Android will verify the certificate and mitigate possible MiM attacks (that would be the only weak point in all this). You can send sensitive data through HTTPS connections that it will be encrypted during transport. Just your app and the server will know any parameters sent through https.

The only "maybe" here would be if client or server are infected with malicious software that can see the data before it is wrapped in https. But if someone is infected with this kind of software, they will have access to the data, no matter what you use to transport it.

@SoapBox 2009-01-31 21:20:09

Yes and no.

The server address portion is NOT encrypted since it is used to set up the connection.

This may change in future with encrypted SNI and DNS but as of 2018 both technologies are not commonly in use.

The path, query string etc. are encrypted.

Note for GET requests the user will still be able to cut and paste the URL out of the location bar, and you will probably not want to put confidential information in there that can be seen by anyone looking at the screen.

@Lawrence Dol 2009-01-31 22:11:07

Would like to +1 this, but I find the "yes and no" misleading - you should change that to just point out that the server name will be resolved using DNS without encryption.

@greg7gkb 2010-01-26 05:16:07

Wait, where is the author using the word URL in an incorrect sense?

@Guillaume 2010-11-02 14:17:47

In my understanding, the OP uses the word URL in the right sense. I think this answer is more misleading, as it doesnt clearly makes the difference between the hostname in the URL and the hostname in the DNS resolution.

@Marquis of Lorne 2013-03-26 09:37:39

The URL is encrypted. Every aspect of the HTTP transaction is encrypted. Not just 'everything else'. Period. -1.

@SoapBox 2013-03-26 10:28:18

@EJP Except the DNS lookup of the host. Which is not. Period.

@Marquis of Lorne 2013-03-26 11:23:32

Which is not part of the HTTPS transaction, contrary to the misleading impression you are continuing to give here.

@trusktr 2014-06-26 18:46:46

@EJP but the DNS lookup does use what is at one point part of the URL, so to the non-technical person, the entire URL is not encrypted. The non-technical person who's merely using Google.com to look up non-technical things does not know where the data ultimately resides or how it is handled. The domain, which is part of the URL the user is visiting, is not 100% encrypted because I as the attacker can sniff which site he is visiting. Only the /path of a URL is inherently encrypted to the layman (it doesn't matter how).

@Pacerier 2015-11-09 21:40:10

@EJP, @​trusktr, @​Lawrence, @​Guillaume. All of you are mistaken. This has nothing to do with DNS. SNI "send the name of the virtual domain as part of the TLS negotiation", so even if you don't use DNS or if your DNS is encrypted, a sniffer can still see the hostname of your requests.

@Muhammad Umer 2016-05-24 18:59:55

so in GET request Parameters are encrypted but not hostname + url upto params, but in user browser history or proxy server log it will contain full unecnrypted url

@Marc Novakowski 2009-01-31 21:17:39

Yes, the SSL connection is between the TCP layer and the HTTP layer. The client and server first establish a secure encrypted TCP connection (via the SSL/TLS protocol) and then the client will send the HTTP request (GET, POST, DELETE...) over that encrypted TCP connection.

@Michael Ekstrand 2009-07-12 01:37:56

It is still worth noting the thing mentioned by @Jalf in the comment on the question itself. URL data will also be saved in the browser's history, which may be insecure long-term.

@user142019 2011-03-02 22:13:46

Not just GET or POST. Can also be DELETE, PUT, HEAD, or TRACE.

@Jason Sebring 2013-01-18 22:05:27

I would like to add to keep in mind how Amazon does this. They use a public and a secret key pair with an expiration date on the request. You must sign your JSON request using Sha1 and your private key. You then send your public key across the line. Amazon then looks up your secret key internally by using your public key, then signs the JSON. It must match or the request is rejected. This allows you to send URLs as temporary requests. Something to consider to emulate when rolling your own approach.

@zingle-dingle 2013-05-28 23:12:56

Yes it could be a security issue for a browser's history. But in my case I'm not using browser (also the original post did not mention a browser). Using a custom https call behind the scenes in a native app. It's a simple solution to making sure your app's sever connection is secure.

@ChewToy 2013-06-19 07:35:36

Note however that the DNS resolve of the URL is probably not encrypted. So someone sniffing your traffic could still probably see the domain you're trying to access.

@CompanyDroneFromSector7G 2013-10-08 15:40:41

@Jason Sebring that's a strange way to do it. Why don't they use their own private key to sign the JSON?

@Jason Sebring 2013-10-08 20:35:18

@bukko it may be strange but its a standard and I see this across the board on scenarios fitting API consumption.

@Steve Jessop 2014-03-15 11:28:44

@bukko: I think Jason is talking about this kind of thing: docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.h‌​tml, although there's nothing in that specific protocol about JSON. If so then when Amazon "signs the JSON [request] using your secret key", they're confirming the HMAC. It's not a public/private key pair, it's a shared secret with Amazon and a non-secret user identifier.

@cmouse 2014-08-27 06:41:59

SNI breaks the 'host' part of SSL encryption of URLs. You can test this yourself with wireshark. There is a selector for SNI, or you can just review your SSL packets when you connect to remote host.

@smileycreations15 2019-05-08 16:09:44

@ChewToy DNS over HTTPS (DoH) fixes that. But it is still possible to found out which domain the user is connected to by the IP-domain matches even with DoH.

@Tessaracter 2019-12-23 18:41:27

This Answer is misleading. The URL is encrypted does not mean all the details are hidden. The domain name will still be visible

@Don Gillis 2016-11-17 02:49:47

You can not always count on privacy of the full URL either. For instance, as is sometimes the case on enterprise networks, supplied devices like your company PC are configured with an extra "trusted" root certificate so that your browser can quietly trust a proxy (man-in-the-middle) inspection of https traffic. This means that the full URL is exposed for inspection. This is usually saved to a log.

Furthermore, your passwords are also exposed and probably logged and this is another reason to use one time passwords or to change your passwords frequently.

Finally, the request and response content is also exposed if not otherwise encrypted.

One example of the inspection setup is described by Checkpoint here. An old style "internet café" using supplied PC's may also be set up this way.

@JoshBerke 2016-04-15 15:28:31

Linking to my answer on a duplicate question. Not only is the URL available in the browsers history, the server side logs but it's also sent as the HTTP Referer header which if you use third party content, exposes the URL to sources outside your control.

@Liam 2016-11-10 16:46:05

Providing your third party calls are HTTPS aswell though this isn't an issue right?

@JoshBerke 2016-11-11 18:03:29

It'd be encrypted with the third parties certificate so they could see the URL

@pbhj 2015-08-14 16:03:26

A third-party that is monitoring traffic may also be able to determine the page visited by examining your traffic an comparing it with the traffic another user has when visiting the site. For example if there were 2 pages only on a site, one much larger than the other, then comparison of the size of the data transfer would tell which page you visited. There are ways this could be hidden from the third-party but they're not normal server or browser behaviour. See for example this paper from SciRate, https://scirate.com/arxiv/1403.0297.

In general other answers are correct, practically though this paper shows that pages visited (ie URL) can be determined quite effectively.

@Cameron 2015-08-21 18:39:44

That would really only be feasible on very small sites, and in those cases, the theme/tone/nature of the site would probably still be about the same on each page.

@pbhj 2015-09-04 10:15:05

From the citation I gave: "We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 89% accuracy [...]". It seems your conclusion as to feasibility is wrong.

@Dan Bechard 2016-04-18 18:18:24

For anyone interesting in reading more about this sort of vulnerability, these types of attacks are generally referred to as side-channel attacks.

@Peter Štibraný 2009-01-31 21:17:50

Entire request and response is encrypted, including URL.

Note that when you use a HTTP Proxy, it knows the address (domain) of the target server, but doesn't know the requested path on this server (i.e. request and response are always encrypted).

@Sam Sirry 2019-07-21 23:05:21

The the entirety of the request. The Host Name is sent in the clear. All else is encrypted.

@Tobias 2013-07-28 06:49:31

I agree with the previous answers:

To be explicit:

With TLS, the first part of the URL (https://www.example.com/) is still visible as it builds the connection. The second part (/herearemygetparameters/1/2/3/4) is protected by TLS.

However there are a number of reasons why you should not put parameters in the GET request.

First, as already mentioned by others: - leakage through browser address bar - leakage through history

In addition to that you have leakage of URL through the http referer: user sees site A on TLS, then clicks a link to site B. If both sites are on TLS, the request to site B will contain the full URL from site A in the referer parameter of the request. And admin from site B can retrieve it from the log files of server B.)

@trusktr 2014-06-26 18:37:11

@EJP You didn't understand what Tobias is saying. He's saying that if you click a link on site A that will take you to site B, then site B will get the referrer URL. For example, if you are on siteA.com?u=username&pw=123123, then siteB.com (which is linked to on the page of siteA.com) will receive "siteA.com?u=username&pw=123123" as the referring URL, sent to siteB.com inside the HTTPS by the browser. If this is true, that's very bad. Is this true Tobias?

@Buge 2014-12-13 16:10:07

@EJP, the domain is visible because of SNI which all modern web browsers use. Also see this diagram from the EFF showing that anyone can see the domain of the site you are visiting. This isn't about browser visibility. It's about what is visible to eavesdroppers.

@Martin Geisler 2015-08-06 14:38:51

@trusktr: Browsers should not send a Referer header from HTTPS pages. This is part of the HTTP specification.

@Pacerier 2015-11-09 21:34:08

@MartinGeisler, Keyword is "should". Browsers don't much care about "should" (as opposed to "must"). From your own link: "strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable /disable the sending of Referer and From information". Ops, which is exactly what Chrome did. Except Chrome leaks the Referrer even if you are in incognito mode.

@Rhodri Cusack 2010-11-02 14:03:18

An addition to the helpful answer from Marc Novakowski - the URL is stored in the logs on the server (e.g., in /etc/httpd/logs/ssl_access_log), so if you don't want the server to maintain the information over the longer term, don't put it in the URL.

@Zach Scrivena 2009-01-31 21:26:58

As the other answers have already pointed out, https "URLs" are indeed encrypted. However, your DNS request/response when resolving the domain name is probably not, and of course, if you were using a browser, your URLs might be recorded too.

@Steve Jessop 2011-09-26 08:38:59

And URL recording is important since there are Javascript hacks that allow a completely unrelated site to test whether a given URL is in your history or not. You can make a URL unguessable by including a longish random string in it, but if it's a public URL then the attacker can tell that it has been visited, and if it has a short secret in it, then an attacker could brute-force that at reasonable speed.

@Pacerier 2014-03-15 10:25:52

Isn't there encrypted DNS as well?

@Pacerier 2014-03-15 10:26:48

@SteveJessop, please provide a link to "Javascript hacks that allow a completely unrelated site to test whether a given URL is in your history or not"

@Steve Jessop 2014-03-15 10:49:28

@Pacerier: hacks date of course, but what I was talking about at the time was things like stackoverflow.com/questions/2394890/…. It was a big deal back in 2010 that these issues were being investigated and the attacks refined, but I'm not really following it at the moment.

@Steve Jessop 2014-03-15 11:19:27

@Pacerier: more examples: webdevwonders.com/…, webdevwonders.com/…

@SPRBRN 2014-04-22 15:02:00

You can use OpenDNS with it's encrypted DNS service. I use it on my Mac, but I found the Windows version not working properly. That was a while ago though, so it might work OK now. For Linux nothing yet. opendns.com/about/innovations/dnscrypt

Related Questions

Sponsored Content

30 Answered Questions

12 Answered Questions

[SOLVED] How to make an HTTP POST web request

22 Answered Questions

[SOLVED] Python Requests throwing SSLError

21 Answered Questions

[SOLVED] How is an HTTP POST request made in node.js?

8 Answered Questions

[SOLVED] Are HTTPS headers encrypted?

18 Answered Questions

[SOLVED] PHP Get Site URL Protocol - http vs https

  • 2010-12-21 19:30:18
  • anon445699
  • 238150 View
  • 199 Score
  • 18 Answer
  • Tags:   php url ssl

11 Answered Questions

3 Answered Questions

[SOLVED] HTTP Basic Authentication credentials passed in URL and encryption

1 Answered Questions

[SOLVED] HTTPs URL encryption

Sponsored Content