Can one send data securely to a REST API endpoint

Question

Say I have an endpoint to create a username:

• https://example.com/api/create_user/foo/1234/ or
• https://example.com/api/create_user/?name=foo&token=1234

Where username = foo and the api token is 1234:

Surely since foo and 1234 is encoded in the URL, it is public? My research says TLS encryption only encypts the body because the DNS servers need to know where to route the request.

QUESTION: Does this mean it is not secure to post data to a REST API endpoint?

Disclaimer, I guess one could encrypt the data first before putting it in the URL, e.g.:

• Encrypt the name foo -> FF8811A
• Encrypt the token -> AABBCCDDEEFF1122

And then request https://example.com/api/set_username/FF8811A/AABBCCDDEEFF1122/, and then the server decrypts the parameters.

Answer 1

With https, the client must first do a DNS lookup of the hostname (in your case, example.com), so this part of the URL could leak during this step*. Also, the hostname may be sent in cleartext to the server in the SNI header**.

But, at this stage, the client and the server initiate a TLS session. Then, the client sends the entire URL in the http request to the server.

So, to answer your question: in your examples, https://example.com/ could be seen by a passive observer, but everything in the URL after this is encrypted by TLS.

---

*Although this could be mitigated using DNS over HTTPS (DoH) or DNS over TLS (DoT).

**Although TLS1.3 has provisions for encrypting SNI