Are HTTPS headers encrypted?

security post encryption https get
Dan Herbert picture Dan Herbert · Oct 9, 2008 · Viewed 237k times · Source

When sending data over HTTPS, I know the content is encrypted, however I hear mixed answers about whether the headers are encrypted, or how much of the header is encrypted.

How much of HTTPS headers are encrypted?

Including GET/POST request URLs, Cookies, etc.

Answer

Greg picture Greg · Oct 9, 2008

The whole lot is encrypted† - all the headers. That's why SSL on vhosts doesn't work too well - you need a dedicated IP address because the Host header is encrypted.

†The Server Name Identification (SNI) standard means that the hostname may not be encrypted if you're using TLS. Also, whether you're using SNI or not, the TCP and IP headers are never encrypted. (If they were, your packets would not be routable.)

Related questions

How secure is a HTTP POST?

Is a POST secure enough to send login credentials over? Or is an SSL connection a must?

Read More
Do I need a CSRF token for jQuery .ajax()?

So I've got a basic .ajax() POST method to a PHP file. What security measures do I need? A few posts around were mentioning using a hidden MD5 input field that you send via AJAX and verify in the PHP …

Read More
ModSecurity maximum post limits (PCRE limit errors)

I've been having tonnes of issues with Mod Security. I am busy writing a CMS for a project at work and while developing a page to edit a certain database record I kept getting 403 errors. After hours of banging my …

Read More