47

I'm developing a client/server app that will communicate via rest. Some custom request data will be stored in the header of the request. Both the server sending the request and the receiving server have an SSL certificate - will the headers be encrypted, or just the content?

8 Answers 8

65

SSL encrypts the entire communications path from the client to the server and back, so yes - the headers will be encrypted.

By the way, if you develop networked applications and care about data security, the least you should do is read a book like Practical Cryptography, by Niels Ferguson and Bruce Schneier, and probably further reading that's more focused on web application security would be a good idea. If I may make an observation - and please, I don't mean that as a personal criticism - your question indicates a fundamental lack of understanding of very basic web security technologies, and that's never a good sign.

Also, it's never a bad idea to confirm that data which is assumed to be encrypted is indeed encrypted. You can use a network analyzer to monitor traffic on the wire and watch out for anything sensitive being sent in the clear. I've used Wireshark to do this before - the results can be surprising, sometimes.

2
  • 1
    Thanks, that's very much appreciated. I was confident in the answer, but have to have this confirmed (for the powers that be) before we start development. Cheers! Sep 16, 2008 at 16:04
  • 4
    "SSL encrypts the entire communications path" ... except for the IP and TCP headers. Jun 7, 2012 at 18:55
6

As long as you're communicating in the SSL tunnel, everything sent between the server and the client will be encrypted. The encryption is done before any data is sent or received.

5

Both headers and content are encrypted.

3

You appear to think that REST is a distinct protocol.

REST is not a protocol. It is a design style for HTTP-based applications.

So, your a writing an HTTP application. Are the headers encrypted? Yes, if you are using the HTTPS (HTTP over SSL) protocol instead of plain HTTP.

Having certificates on both sides is not directly relevant to your question. SSL certificates are used for authentication. They help in detecting man-in-the-middle attacks such as are possible using DNS cache poisoning.

1
  • Thanks, but i'm aware that REST is a methodology rather than a protocol. Sep 16, 2008 at 16:02
2

Having a certificate is not enough, you have to configure the web server to encrypt the connections (that is, to use the certificate) for that domain or virtual host. In addition, I think you would just need a single certificate, responses to requests will still be encrypted.

And yes, HTTP headers are encrypted as well as the data.

1

The other answers are correct that headers are indeed encrypted, along with the body, when using SSL. But keep in mind that the URL, which can include query parameters, is never encrypted. So be careful to never put any sensitive information in URL query parameters.

Update: as @blowdart pointed out below, this is wrong. See the comment below.

4
  • 4
    No, not exactly true. Query parameters are sent after the handshake and thus are encrypted; SSL specifically strips them and sends them as part of the page block.
    – blowdart
    Sep 18, 2008 at 14:42
  • 9
    @blowdart - very true, but browsers will still capture query strings in their history. So best not to use sensitive information in a query string.
    – Matt
    Jul 10, 2009 at 19:46
  • 1
    I’ve since confirmed that @blowdart is correct; my answer was wrong.
    – Avi Flax
    May 2, 2012 at 20:35
  • 3
    @Avi: I think you should edit your answer to reflect your 'newest knowledge', i.e. that you were wrong, instead of commenting it. Just my 2 cents :) Sep 12, 2012 at 14:48
0

SSL..or rather HTTPS (HTTP over SSL) sends all HTTP content over SSL, and as HTTP content and headers are in fact the same thing, this means the headers are encrypted as well. Seeing as GET and POST data is sent via HTTP headers, then it only makes sense then when sending data securely you wouldn't just want the response code or content to be encrypted.

2
  • HTTP content and headers are not the same thing, and POST data is not sent via HTTP headers, it is sent in the request body.
    – Jim
    Sep 16, 2008 at 15:30
  • The information given by Wesley is incorrect. POST puts the data in the body of the message.
    – Dylan
    Mar 28, 2012 at 21:39
-3

Not everything is encrypted: the request query string is not encrypted. Believe me, I've seen requests like this:

https://mydomain.com/authenticate?user=username&password=MyStrongPasswordSentInTheClear

Please don't put sensitive data as parameters in the query string.

2
  • 2
    Even the query is protected by SSL/TLS between your browser and the server.
    – Bruno
    Apr 24, 2012 at 21:55
  • Not true. Everything after mydomain.com is sent on the wire inside the HTTP GET/POST/etc. request and as such it is encrypted. The URL string itself however usually leaks in parallel logical paths, e.g. in browser history, logs, saved links, favorites, toolbars, server logs; and probably what is the worst - in some web analytical references. Since the original question is about REST, many of these are irrelevant. Whatever it is, as a best practice, my personal rule of thumb is: "do not put sensitive data (passwords, PII, DB IDs) in URLs."
    – Valo
    Apr 9, 2014 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.