First a little context as a lot of people have been confused by my question in the past.Everything in the 2 requests below is visible to a third party (man in the middle attack), url, data, host name, both ip addressed, etc.POSThttp://foo.com/POST Data {  foo: me,  bar: you  }GEThttp://foo.com?foo=me&bar=youI belive only host name and both ip addresses are visable to the third party with the POST request below.https://foo.comPOST Data {  foo: me,  bar: you}My question, is the same viable or is the GET data also visible compared to the POST request over https with this one?https://foo.com?foo=me&bar=you
HTTP and HTTPS visibility question
https;http
First, this kind of question is better asked at security.se. It was asked there several times and has extensive answers. See for example https://security.stackexchange.com/questions/12531/ssl-with-get-and-post.In short: HTTPS is just HTTP inside a TLS tunnel. This means that both HTTP request and HTTP response are protected by TLS and thus the parameter are encrypted for GET and for POST requests. But there are several reasons why you should use POST anyway, like data from GET leaking into HTTP referer, log files etc.