Home / server / Questions / 186445
Accepted
James Cadd
Asked: 2010-10-01 20:26:13 +0800 CST

Can an attacker sniff data in a URL over HTTPS?

  • 772

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it be possible for an attacker to grab "mysecretstring" from the URL?

url security https

5 Answers

  1. Best Answer

    The entire HTTP request (and response) is encrypted, including the URL.

    But yes, there is a way an attacker could grab the full URL: through the Referer header. If there is any external file (Javscript, CSS, etc.) which is not over HTTPS, the full URL could be sniffed in the Referer header. Same if the user click on a link in the page that leads to an HTTP (no SSL) page.

    Also, DNS requests are not encrypted, so an attacker could know the user is going to mysite.com.

    • 26

  2. No, they can see the connection ie mysite.com but not the ?mysecretstring=1234 the https is server to server

    • 14

  3. They would need to have the encryption key. Theoretically this is not possible but any good attack could. This is the whole purpose of SSL to encrypt all data sent to and from the server to prevent being able to sniff.

    • 0

  4. Keep your weblogs secure, or, don't even write them. If you get a remote exploit where the logs can be read, any URL data will be visible in the logs.

    • 0

  5. Only if they are able to sniff the https auth through some kind of spoofing

    • -1