I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible.
When I generate a connection string there is a SAS token embedded in the URL. That token has different permissions parameters and they are signed with the service private key.
But I don't understand how putting this SAS token in the URL is safe. If I launch such a URL with the token in it, what prevents it to be read by a network sniffer or proxy? If the URL can be read then I see no security in Shared Access Signatures. So I must be missing the point.
Is there any chance the parameters after the ? in the URL aren't sent and kept for the client? If so, I guess we have to rely on the client security and trust it. Am I right?