I would like to visit a site which supports HTTPS but to allow as few third-parties as possible to know which site I am visiting, excluding onion sites, through the HTTP Host Header.
As I currently know, the HTTP Host Header can be viewed in plaintext by anyone monitoring my network (when visiting HTTPS sites) and I would like to mitigate this as much as possible.
An inefficient solution I thought of would be to create an open-source website which supports SSL (say, HTTPHostHider.com) that creates the connection and securely transfers the requested site's public key to the client. Below is what I mean.
- Client wants to see contents of example.com
- Client request headers sent to https://HTTPHostHider.com
- HTTPHostHider.com returns example.com response headers and public key
- Client send encrypted contents to HTTPHostHider.com
- HTTPHostHider.com sends request to example.com
- example.com sends page contents to HTTPHostHider.com
- HTTPHostHider.com sends page contents to client
from what I understand, if the client directly contacts https://example.com then the HTTP HOST header can be seen by eavesdroppers (and thus deduce what I was doing on that site - the URL reveals what it is for - eg. freeporn.org).
So my question is: How do I not leak my HTTP Host Header?
Sorry if question not clear; English is not my first language