Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST request is sent. What is initially sent is a stripped down version of a GET/POST request to initiate the SSL.
When the SSL is initiated, as for my knowledge, an evesdropper can only see the destination IP, source IP and the PORT in the TCP/IP packet. Everything else is encrypted. please do correct me again, if I have wrong idea about the same. This is merely a collected set of information to which I require confirmation.
If What I have said so far is correct,
calling the URL: www.websiteurl.com?username=name&password=PASSWORD
Should be perfectly safe as long as only an eavesdropper looking at the packets travelling between server and client is concerned. I know since URLs are logged everywhere in the local computer it can be dangerous. I am not planing to implement a system with this knowledge, but I do need to confirm if I know what I know correctly.
So would it be safe to send sensitive information over GET when using HTTPS after the SSL session is initiated with the server?
This question may have no practical implementation as sending sensitive information over URLs is not needed.