This question already has an answer here:
I understand that SSL connections already has its layer of encryption to protect data transmitted between a client and server.
Assuming that my connection has SSL, does it still make sense for me to encrypt data that is transferred between a client and server using keys?
For instance, I might be sending and calling a REST API with sensitive information. Can I just send them in clear text over HTTPS? I believe this should already be safe with SSL right?
Or should I still encrypt sensitive data before sending? But does it even still make sense to double encrypt the data since I'm already on a HTTPS connection?