Is GET data also encrypted in HTTPS?

When you GET

https://encrypted.google.com/search?q=%s

The %s query is encrypted? Or just the response? If it is not, why should Google serve it’s public content also with encryption?

The entire request is encrypted, including the URL, and even the command (GET). The only thing an intervening party such as a proxy server can glean is the destination address and port.

Note, however, that the Client Hello packet of a TLS handshake can advertise the fully qualified domain name in plaintext via the SNI extension (thanks @hafichuk), which is used by all modern mainstream browsers, though some only on newer OSes.

EDIT: (Since this just got me a “Good Answer” badge, I guess I should answer the entire question…)

The entire response is also encrypted; proxies cannot intercept any part of it.

Google serves searches and other content over https because not all of it is public, and you might also want to hide some of the public content from a MITM. In any event, it’s best to let Google answer for themselves.

https://stackoverflow.com/questions/4143196/is-get-data-also-encrypted-in-https

Is GET data also encrypted in HTTPS? was last modified: March 1st, 2020 by Jovan Stosic

Leave a Reply