Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is it safe to perform URL encoding of the data? Though it is using HTTPS, it does not make it not susceptible to MITM attacks, I suppose. Or I am able to easily decode this URL encoding because I am viewing the traffic using Burp Suite? If not, the data should be encrypted and not encoded is what I think.

Kindly clarify this.

1 Answer 1


I assume that you encountered the content-type application/x-www-form-urlencoded for POST data, which is the default type if nothing else is given in a form. As the name suggests - the request body is urlencoded in this case. This is no attempt to protect the data but only to guarantee a clear interpretation, i.e. where a input name starts and ends, where the value starts and ends etc.

Insofar the question if it is safe makes no sense, since it is not intended to add safety in the first place. The safety is instead added by HTTPS, which protects against sniffing and modifying the data by an untrusted man in the middle.

If not, the data should be encrypted and not encoded is what I think.

This is what HTTPS does. Only you are using Burp and have your browser setup to make Burp a trusted man in the middle, able to decrypt and modify the traffic.

  • The explanation is pretty clear. Got it :) Thanks for your time.
    – Supraja
    Apr 18, 2022 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .