16

I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants to go to IP xxx.xx.xxx.xxxx and then the packets are routed to that IP address across the Internet. But if the URL in an HTTPS message is encrypted then how can the packets be routed? If a DNS gets a request for an encrypted URL, how do they know where to send the packets?

26

The DNS server does not look at the URL; the DNS server does not know what a URL could be.

The client browser extracts the intended server name from the URL. In a URL like https://www.example.com/foobar.html, the server name is the part after the https:// but before the next /; i.e., www.example.com in this example. The server name is what is sent to the DNS.

The DNS responds with the IP address for that server. The client then talks with that server, they do their SSL magic, and once the tunnel has been established (and only then), the client sends the URL (specifically, the part after the server name, in my example /foobar.html) to the server. And that one goes in the tunnel, hence encrypted.

This answer is a walk through the SSL protocol.

0

Now for the rest of the story:

Yes, your URL data is encrypted en-route to the web server. However, what others are neglecting to tell you is this: Once on the web server itself, your URL can be logged to the logging file, and if so, regardless of whether or not you used SSL, the entire "GET" string will be posted into that log file.

If you are using an outbound proxy server, such as is often found at a company or the federal government offices, your outbound SSL connection is read by that proxy server and it can also be, thus, stored unencrypted at the proxy server in its logs. (Don't believe me? Look up how proxy servers work)

  • 1
    This is true only for ssl-interception proxies. It also requires that you have installed the proxy's cert, or that you ignore a big scary warning page. – AndrolGenhald Jul 10 '18 at 18:18
  • This answer does not appear to apply to DNS, which appears to be the focus of the question. – schroeder Jul 10 '18 at 19:18
  • Of course the webserver can log the GET request. They have access to all the plaintext, so it should not be novel to realize they can log it. – David Jul 10 '18 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.