Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and response.

I ask because an api requires me to pass user data over https(their user's data ofc). The username and password are passed as http AUTH: user:pass@site.com/api/messages

share|improve this question

marked as duplicate by Rook, Adnan, makerofthings7, Lucas Kauffman, NULLZ Jul 10 '13 at 5:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

up vote 6 down vote accepted

HTTPS uses Transport Layer Security (TLS). The Transport layer is layer 4, so everything above this layer is encrypted, which means all of HTTP is encrypted.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.