HTTPS、URL 路径和查询字符串
HTTPS 上的 BASIC 身份验证的问题的后续帖子
这是我的上一个关于 如果我使用 HTTPS，资源和查询字符串会安全地传递到服务器吗？
即
URI： http://server/path/到/a/resource?with=a&query=string
服务器：服务器
路径： /path/to/a/resource
查询字符串： with=a&query=string
This is a follow up post of my previous question about BASIC auth over HTTPS
Are the path to the resource and query string passed securely to the server if I use HTTPS?
i.e.
URI: http://server/path/to/a/resource?with=a&query=string
Server: server
path: /path/to/a/resource
query string: with=a&query=string
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是对此的一个很好的解释：http://answers.google。 com/answers/threadview/id/758002.html#answer
摘要：只有主机和端口未加密时可见。
简而言之，是的。但是您不应该在 URL 中存储敏感数据，因为它可能在浏览器历史记录和服务器日志文件中可见。任何回头看你的人也会看到这一点。
This is a really good explanation of this: http://answers.google.com/answers/threadview/id/758002.html#answer
Summary: only the host and port would be visible unencrypted.
In short, yes. But you shouldn't store sensitive data in URL's since it may be visible in the browsers history and server logfiles. And anyone who looks over your shoulder sees it too.
是的，整个会话都是安全和加密的，因此您发送的任何内容（包括查询字符串）都是不可读的。
如果您愿意，您可以通过使用类似 Fiddler 查看 http/https 来向自己证明这一点当您访问安全网址时产生的流量。您通过 HTTPS 发送的任何内容都不会显示查询字符串，如下所示：
我访问的实际 URL 如下所示:
根据其他答案，您不应在查询字符串中传递任何敏感信息，因为这可能存储在您的网络服务器日志文件中，因此如果您传递用户名/密码组合任何可以访问您日志的人都可以捕获该信息。这可能允许某人像其他人一样登录您的网站/应用程序，即使您正在努力将密码作为加盐哈希值而不是纯文本存储在数据库中。
Yes it is - the entire session is secured and encryped so anything you send, including the query string is unreadable.
You can prove this to yourself, if you wish, by using something like Fiddler to view the http/https traffic you generate when you visit a secure url. Anything you send over HTTPS will not show the querystring, as shown here:
The actual URL I was visiting looked like this:
As per other answers, you shouldn't pass any sensitive information in the querystring as this may be stored in your webservers log files, so if you were passing a username/password combination anyone who could access your logs would be able to capture that information. This could allow someone to log into your site/application as if they were someone else even if you were making efforts such as storing passwords in your database as salted hashes, rather than plaintext.
HTTPS 只是通过 SSL 连接建立 HTTP 隧道。这意味着请求、响应、标头和内容都在 SSL 隧道内，因此应该加密。
HTTPS is simply HTTP tunnelled over an SSL connection. This means that the request, response, headers and content are all within the SSL tunnel and should therefore be encrypted.