GET 数据是否也在 HTTPS 中加密？
When you GET
https://encrypted.google.com/search?q=%s
Is the %s query encrypted? Or just the response?
If it is not, why should Google serve its public content also with encryption?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（11）
以上是来自 Google 问答的非常全面的答案的一部分，位于此处：
http ://answers.google.com/answers/threadview/id/758002.html#answer
The above is a part of a VERY comprehensive answer from Google Answers located here:
http://answers.google.com/answers/threadview/id/758002.html#answer
安全发送主机名之后的 URL 部分。
例如，
https://somewhere.com/index.php?NAME=FIELD
/index.php?NAME=FIELD部分已加密。somewhere.com则不然。The portion of the URL after the host name is sent securely.
For example,
https://somewhere.com/index.php?NAME=FIELD
The
/index.php?NAME=FIELDpart is encrypted. Thesomewhere.comis not.所有内容都已加密，但您需要记住，您的查询将保留在服务器日志中，并且可以被各种日志分析器等访问（POST 请求通常不是这种情况）。
Everything is encrypted, but you need to remember, that your query will stay in server's logs and will be accessible to various log analysers etc (which is usually not the case with POST request).
在传输请求之前，连接会被加密。所以是的，请求也被加密，包括查询字符串。
The connection gets encrypted before the request is transmitted. So yes, the request is encrypted as well, including the query string.
我刚刚通过 HTTPS 连接到一个网站并传递了一堆 GET 参数。然后我使用wireshark来嗅探网络。使用 HTTP，URL 未加密发送，这意味着我可以轻松查看 URL 中的所有 GET 参数。使用 HTTPS，一切都被加密，我什至看不到哪个数据包是 GET 命令，更不用说它的内容了！
I just connected via HTTPS to a website and passed a bunch of GET parameters. I then used wireshark to sniff the network. Using HTTP, the URL is sent unencrypted, which means I can easily see all the GET parameters in the URL. Using HTTPS, everything is encrypted and I can't even see which packet is the GET command, let alone its contents!
是的，它是安全的。 SSL 加密一切。
POST 请求摘录：
GET 请求摘录：
在这两种情况下，在套接字上发送的任何内容都是加密的。客户端在 GET 请求期间在浏览器中看到参数这一事实并不意味着中间人也会看到相同的内容。
Yes, it is secure. SSL encrypts everything.
Excerpt from POST request:
Excerpt from GET request:
In both cases whatever is sent on the socket is encrypted. The fact that the client sees parameters in his browser during a GET request doesn't mean that a man in the middle would see the same.
SSL 发生在标头解析之前，这意味着：
请求看起来像这样（不记得确切的语法，但这应该足够接近）：
这也是为什么同一 IP 上的多个主机拥有不同的 SSL 证书的原因是有问题的，所请求的主机名在解密之前是未知的。
The SSL takes place before the header parsing, this means:
A Request looks something like this (can't remember the exact syntax, but this should be close enough):
This is also why having different SSL Certificates for several hosts on the same IP are problematic, the requested Hostname is not known until decryption.
使用 HTTPS 时，GET 请求会被加密 - 事实上，这就是为什么安全网站需要有唯一的 IP 地址 - 在解密之前，无法从请求中获取预期的主机名（或虚拟目录）。
The GET request is encrypted when using HTTPS - in fact this is why secured websites need to have a unique IP address - there's no way to get the intended hostname (or virtual directory) from the request until after it's been decrypted.
上面有一点混乱：
因此，回答原来的问题。除了主机名（我猜是端口）之外的所有内容在两个方向上都是安全的。
There is a little confusion above:
So, in answer to the original question. Everything EXCEPT the host name (and I guess port) is secured in BOTH directions.
整个请求都是加密的，包括 URL，甚至命令 (
GET)。代理服务器等干预方可以收集的唯一信息是目标地址和端口。但请注意，TLS 握手的客户端 Hello 数据包可以通过 < 以明文方式通告完全限定的域名em>SNI 扩展（感谢 @hafichuk），所有现代主流浏览器都使用该扩展，尽管有些浏览器仅在较新的操作系统上使用。
编辑：（因为这刚刚给我一个“好答案”徽章，我想我应该回答整个问题......）
整个响应也被加密；代理无法拦截其任何部分。
Google 通过 https 提供搜索和其他内容，因为并非所有内容都是公开的，并且您可能还想从 MITM。无论如何，最好让 Google 自己回答< /a>.
The entire request is encrypted, including the URL, and even the command (
GET). The only thing an intervening party such as a proxy server can glean is the destination address and port.Note, however, that the Client Hello packet of a TLS handshake can advertise the fully qualified domain name in plaintext via the SNI extension (thanks @hafichuk), which is used by all modern mainstream browsers, though some only on newer OSes.
EDIT: (Since this just got me a "Good Answer" badge, I guess I should answer the entire question…)
The entire response is also encrypted; proxies cannot intercept any part of it.
Google serves searches and other content over https because not all of it is public, and you might also want to hide some of the public content from a MITM. In any event, it's best to let Google answer for themselves.
URL 本身已加密，因此查询字符串中的参数不会以明文形式通过网络传输。
但是，请记住，包括 GET 数据的 URL 通常由网络服务器记录，而 POST 数据很少记录。因此，如果您打算执行类似
/login/?username=john&password=doe的操作，那就不要这样做；请改用 POST。The URL itself is encrypted, so the parameters in the query string do not travel in plain across the wire.
However, keep in mind that URLs including the GET data are often logged by the webserver, whereas POST data seldom is. So if you're planning to do something like
/login/?username=john&password=doe, then don't; use a POST instead.