2

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data.

Does any standard, or feature exist that allows me to receive a HTTPSCall where I can only see

  • My authentication string
  • The URI being accessed
  • (nothing else, especially not the data)

From a REST-full perspective, this feels like a security guard who can inspect the doors but not see what's inside.

Does any tunneling, or cleartext "shared-variable" exist that allows me to see those properties (like Wireshark, but I have a TCP socket).

  • No, but you could send encrypted requests (and if appropriate responses) such as JWE or XMLenc/SOAP or even PGP or SMIME over plain HTTP, or if you want authentication HTTPS with null encryption in TLS through 1.2 only. – dave_thompson_085 Aug 16 at 0:46
2

If you are asking whether or not an HTTPS connection will show the unencrypted URL in the network data, then the answer is partially YES.

Contrary to the previously accepted answer, the URL does not get encrypted like the rest of the data.

The base URL (ex. amazon.com) will appear as Server Name Indication extension (SNI) unencrypted data. Only the base URL. amazon.com/books will only show amazon.com in the SNI, the /books and beyond will not.

SNI exists to handle virtual hosted servers, multiple web sites hosted on the same IP address.

You can see this for yourself with a line capture. Fire up Wireshark (or whatever), go to a web site and look at the "Client Hello".

enter image description here

  • +1, but please not that this is only for connections with the SNI extension (which will be practically all nowadays, as it's client-initiated), and only exposes the hostname (not the URL, which is what the question is about) – Jenessa Aug 17 at 17:37
1

No, such a thing does not exist in any TLS standard. As per the name, TLS works on the transport layer and has no knowledge of the inner protocols. The URL gets encrypted just like the rest of the data.

Keep in mind that in HTTP, data can be part of the URL. This is known as 'URL parameters' or 'GET parameters'.

You might still want to consider an MITM proxy, or doing the validation on either the clients or server if you control either of those.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.