4 ms·

Unfortunately URLs are not encrypted when using HTTPS. There are cases when a GET request will have potentially sensitive information such as a filter with an e

by rpedela 13y ago

Unfortunately URLs are not encrypted when using HTTPS. There are cases when a GET request will have potentially sensitive information such as a filter with an email address or unique identifier in it. In this case it is best to use one of the other verbs that can have body like POST and put the filter in the body. I like the standard definition of a REST API but sometimes it does not match the real world.

nsenifty 13y ago
Pretty sure URLs are encrypted using HTTPS. The browsers first creates a secure connection with server before sending a single byte of request data.
batbomb 13y ago
That isn't true. URLs are encrypted, otherwise logging in wouldn't work.
- aioprisan 13y ago
  There is no such thing as encrypted URLs. Encrypted parameter values, maybe.. I believe you're referring to SSL, which is the underlying transport protocol.
  - batbomb 13y ago
    I was referring to the fact that the parent said URLS weren't encrypted over HTTPS, which is not true.
jimktrains2 13y ago
You may be referring to URLs being stored in unencrypted media such as logs. Yes never put sensitive data in a URL. But as others said, HTTPS encrypts everything going over it (except the host name in sni)
taspeotis 13y ago
> I like the standard definition of a REST API but sometimes it does not match the real world. Your remark that "URLs are not encrypted when using HTTPS" does not match the real world.
toast0 13y ago
The hostname may not be encrypted: the DNS lookup probably isn't, and if you have an SNI capable user-agent, the hostname is sent over the channel in the clear so that the server can give you the matching cert; but the path and query aren't sent until SSL/TLS are finished.
rpedela 13y ago
Yes you guys are right, and I am not. Sorry. It is still bad practice since the unencrypted URL can be stored in server logs which could be problematic depending on the application, security requirements, compliance requirements, etc. Unencrypted URLs are also stored in the browser history which would not matter unless the API is being called in the browser. http://stackoverflow.com/questions/499591/are-https-urls-encrypted http://stackoverflow.com/questions/499591/are-https-urls-enc...

by rpedela 13y ago

nsenifty 13y ago

Pretty sure URLs are encrypted using HTTPS. The browsers first creates a secure connection with server before sending a single byte of request data.

batbomb 13y ago

That isn't true. URLs are encrypted, otherwise logging in wouldn't work.

aioprisan 13y ago
There is no such thing as encrypted URLs. Encrypted parameter values, maybe.. I believe you're referring to SSL, which is the underlying transport protocol.
- batbomb 13y ago
  I was referring to the fact that the parent said URLS weren't encrypted over HTTPS, which is not true.

jimktrains2 13y ago

You may be referring to URLs being stored in unencrypted media such as logs. Yes never put sensitive data in a URL. But as others said, HTTPS encrypts everything going over it (except the host name in sni)

taspeotis 13y ago

> I like the standard definition of a REST API but sometimes it does not match the real world. Your remark that "URLs are not encrypted when using HTTPS" does not match the real world.

toast0 13y ago

The hostname may not be encrypted: the DNS lookup probably isn't, and if you have an SNI capable user-agent, the hostname is sent over the channel in the clear so that the server can give you the matching cert; but the path and query aren't sent until SSL/TLS are finished.

rpedela 13y ago

Yes you guys are right, and I am not. Sorry. It is still bad practice since the unencrypted URL can be stored in server logs which could be problematic depending on the application, security requirements, compliance requirements, etc. Unencrypted URLs are also stored in the browser history which would not matter unless the API is being called in the browser. http://stackoverflow.com/questions/499591/are-https-urls-encrypted http://stackoverflow.com/questions/499591/are-https-urls-enc...