31

I really, really thought I remembered seeing the existence of some standardized header or TLS packet whose purpose is to (try to) hide the length of the requested URL from an eavesdropper. But I cannot find anything about this at this time.

What — if any — measures does HTTPS use to decrease the eavesdropper's ability to guess the length of the requested path?

Improve this question
1
  • 10
    TLS supports record padding to hide the length of the payload - although I don't know if TLS clients actually use it in practice. A client could also simply add nonsense fields to the HTTP header as a form of application level padding to hide the length of the relevant parts (including the URL) in the request.
    – Steffen Ullrich
    Commented May 30, 2022 at 4:07

2 Answers 2

Reset to default
34

HTTPS / TLS does not try to hide the length of URL. If someone intercepts traffic, the only things that are visible are host, port and the volume of the traffic. It is impossible to know what this traffic contains. For instance, 10000 bytes traffic can mean a GET request where 9000 bytes are used by URL and 1000 bytes by cookies. Or it can be a POST request with a short URL of 50 bytes, 1000 bytes cookies and about 9000 bytes payload.

Improve this answer
10
  • 2
    Would combining the cookies, payload and request-path into an incoherent blob not constitute an effort to hide the URL length (and the length of all the other bits and bobs)?
    – ScottishTapWater
    Commented May 30, 2022 at 9:46
  • 9
    Or it could be another application transmitting data through TLS - it's not HTTPS at all.
    – iBug
    Commented May 30, 2022 at 12:24
  • 5
    It's probably worth noting that in addition to host and port, the domain name is typically visible via SNI.
    – Aaron Dufour
    Commented May 30, 2022 at 12:34
  • 5
    @JamesTheAwesomeDude I interpreted "host and port" to be the TCP address, in which the host is actually just an IP address, not "host" in the same sense as the HTTP header by that name. In this context that feels like the right interpretation, but I guess only the author of this answer could tell us for sure.
    – Aaron Dufour
    Commented May 30, 2022 at 19:13
  • 4
    @Nzall: This is down to implementation quality. The client can send whatever it wants, and the server can either accept it or respond with HTTP 414 URI Too Long. A server could be implemented to fail at 200 bytes, or even less, but I should like to believe that common implementations are more robust than that.
    – Kevin
    Commented May 31, 2022 at 7:27
1

The other answer already explains that it is really the size of the request header that matters. TLS allows padding to be added. And so does HTTP. Since HTTP/2, the data frame which is used to send requests can have padding. The use of padding is discussed in Chapter 10.7. Just read the specs. Even without access to these facilities, say AJAX in a browser, the script can simply pad the request path or body to a set length.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .