I am wondering if the "/todo1" part of the below URL
curl https://someserver:5000/todo1 -d "data=Remember the milk" -X PUT
Gets encrypted over TLS/HTTPS, or is the full URL that you're sending your request to visible to a middle man?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Your curl command.first triggers a DNS request to resolve
someserver. So even if the whole will get encrypted man can still get this information.
Then a TLS tunnel is created to this server to the port you specified (5000 in your exemple). This would trigger certificate exchange and keys exchange to encrypt the HTTP request itself.
The whole HTTP protocol being encrypted in the TLS tunnel, none of their methods would be available for a man-in-the-middle.
You can verify it by using
wireshark while running your command.