Burp suite: URL encoding of request body - Is this safe?

Question

Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is it safe to perform URL encoding of the data? Though it is using HTTPS, it does not make it not susceptible to MITM attacks, I suppose. Or I am able to easily decode this URL encoding because I am viewing the traffic using Burp Suite? If not, the data should be encrypted and not encoded is what I think.

Kindly clarify this.

Answer 1

I assume that you encountered the content-type application/x-www-form-urlencoded for POST data, which is the default type if nothing else is given in a form. As the name suggests - the request body is urlencoded in this case. This is no attempt to protect the data but only to guarantee a clear interpretation, i.e. where a input name starts and ends, where the value starts and ends etc.

Insofar the question if it is safe makes no sense, since it is not intended to add safety in the first place. The safety is instead added by HTTPS, which protects against sniffing and modifying the data by an untrusted man in the middle.

If not, the data should be encrypted and not encoded is what I think.

This is what HTTPS does. Only you are using Burp and have your browser setup to make Burp a trusted man in the middle, able to decrypt and modify the traffic.