Say I have an endpoint to create a username:

  • https://example.com/api/create_user/foo/1234/ or
  • https://example.com/api/create_user/?name=foo&token=1234

Where username = foo and the api token is 1234:

Surely since foo and 1234 is encoded in the URL, it is public? My research says TLS encryption only encypts the body because the DNS servers need to know where to route the request.

QUESTION: Does this mean it is not secure to post data to a REST API endpoint?

Disclaimer, I guess one could encrypt the data first before putting it in the URL, e.g.:

  • Encrypt the name foo -> FF8811A
  • Encrypt the token -> AABBCCDDEEFF1122

And then request https://example.com/api/set_username/FF8811A/AABBCCDDEEFF1122/, and then the server decrypts the parameters.

  • As a best practice, sensitive data should be passed as headers or in the request body, not in the URI. Web servers access logs (which contain the URI) are often stored as plain text! Commented Jul 21, 2021 at 21:37
  • @myron-semack, do you have any recommendation for solving the problem without the data being in the URL? Commented Jul 22, 2021 at 11:57
  • Tell the API provider to fix their stuff! Commented Jul 23, 2021 at 13:28

1 Answer 1


With https, the client must first do a DNS lookup of the hostname (in your case, example.com), so this part of the URL could leak during this step*. Also, the hostname may be sent in cleartext to the server in the SNI header**.

But, at this stage, the client and the server initiate a TLS session. Then, the client sends the entire URL in the http request to the server.

So, to answer your question: in your examples, https://example.com/ could be seen by a passive observer, but everything in the URL after this is encrypted by TLS.

*Although this could be mitigated using DNS over HTTPS (DoH) or DNS over TLS (DoT).

**Although TLS1.3 has provisions for encrypting SNI

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .