3 ms·
Please correct me if I'm wrong. HTTPS will encrypt the URL, but the DNS lookup is in clear. So the "username:password@example.com" part will be sniffable/loggab
by olivier1664 14y ago
Please correct me if I'm wrong.
HTTPS will encrypt the URL, but the DNS lookup is in clear. So the "username:password@example.com" part will be sniffable/loggable.
http://stackoverflow.com/questions/499591/are-https-urls-encrypted http://stackoverflow.com/questions/499591/are-https-urls-enc...
- jewel 14y agoThat's incorrect. The URI library will parse the URL into a hostname, username, and password. Only the hostname is sent to the DNS server. The username and password are sent in the "Authorization" HTTP header, which will be encrypted.