StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p><a href="http://answers.google.com/answers/threadview/id/758002.html" rel="nofollow noreferrer">http://answers.google.com/answers/threadview/id/758002.html</a></p> <blockquote> <p>HTTPS Establishes an underlying SSL connection before any HTTP data is transferred. This ensures that all URL data (with the exception of hostname, which is used to establish the connection) is carried solely within this encrypted connection, and is protected from man-in-the-middle attacks in the same way that any HTTPS data is.</p> <p>All HTTP-level transactions within an HTTPS connection are conducted within the established SSL session, and no query data is transferred before the secure connection is established.</p> <p>From the outside the only data that is visible to the world is the hostname and port you are connecting to. Everything else is simply a stream of binary data which is encrypted using a private key shared only between you and the server.</p> <p>In the example you provide your browser would do this: </p> <ol> <li>Derive hostname (and port if present) from URL. </li> <li>Connect to host. </li> <li>Check certificate (it must be 'signed' by a known authority, applied specifically to correct IP address and port, and be current). </li> <li>The browser and server exchange cryptographic data and the browser receives a private key. </li> <li>The HTTP request is made, and encrypted with established cryptography. </li> <li>HTTP response is received. Also encrypted. </li> </ol> <p>HTTP is an 'Application Layer' protocol. It is carried on top of the secure layer. According to the SSL specification, drawn up by Netscape, it dictates that no application layer data may be transmitted until a secure connection is established - as outlined in the following paragraph:</p> <p>"At this point, a change cipher spec message is sent by the client, and the client copies the pending Cipher Spec into the current Cipher Spec. The client then immediately sends the finished message under the new algorithms, keys, and secrets. In response, the server will send its own change cipher spec message, transfer the pending to the current Cipher Spec, and send its finished message under the new Cipher Spec. At this point, the handshake is complete and the client and server may begin to exchange application layer data." <a href="http://wp.netscape.com/eng/ssl3/draft302.txt" rel="nofollow noreferrer">http://wp.netscape.com/eng/ssl3/draft302.txt</a></p> <p>So yes. <strong>The data contained in the URL query on an HTTPS connection is encrypted</strong>. However it is <strong><em>very poor</em></strong> practice to include such sensitive data as a password in a 'GET' request. While it cannot be intercepted, the <strong>data would be logged in plaintext server logs</strong> on the receiving HTTPS server, and quite possibly also in <strong>browser history</strong>. It is probably <strong>also available to browser plugins</strong> and possibly even other applications on the client computer. At most a HTTPS URL could be reasonably allowed to include a session ID or similar non-reusable variable. It should NEVER contain static authentication tokens.</p> <p>The HTTP connection concept is most clearly explained here: <a href="http://www.ourshop.com/resources/ssl_step1.html" rel="nofollow noreferrer">http://www.ourshop.com/resources/ssl_step1.html</a></p> </blockquote>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload