Googling the subject "sniffing out / spying on SSL secured communications" one finds many references to being able to make some good guesses about the "target destination" once the path length is known/guessed.
Would it help if one just would make the length (in terms of number of characters) unusually long, which is easy enough to do, so that this "length" of the URL does not fall into the usual patterns?
Assume that a PHP application is sitting on "server1.com" and passes from there (that's where a sniffer would start looking) an API call via SSL to "server2.com". "server2.com" would do nothing else but taking that call and "translate" it to call "server 3.com" (also SSL secured) as the final recipient... Servers 1,2 and 3 are with different ISPs and in different geographic regions.
Would that make it seriously harder to trace where the request goes to (and the answer comes back from, assuming the return would follow the reverse way)?
P.S.: I am asking as we are discussing internally that (just) one aspect of "security" is to limit "the opponents" amount and quality of information he has about your system, which is much easier to assess once he knows where your system is sitting URLwise, hence our ongoing discussion about suitable strategies to obscure the "target destination" for the API call so that this destination is much less likely to be "investigated" about it's systems to identify it's weaknesses (which of course always do exist, to larger or lesser extent)