Comment on Secure Your REST APIparentComments−olivier166413yPlease correct me if I'm wrong. HTTPS will encrypt the URL, but the DNS lookup is in clear. So the "username:password@example.com" part will be sniffable/loggable.http://stackoverflow.com/questions/499591/are-https-urls-enc...−jewel13yThat's incorrect. The URI library will parse the URL into a hostname, username, and password. Only the hostname is sent to the DNS server.The username and password are sent in the "Authorization" HTTP header, which will be encrypted.
Comments
Please correct me if I'm wrong. HTTPS will encrypt the URL, but the DNS lookup is in clear. So the "username:password@example.com" part will be sniffable/loggable.
http://stackoverflow.com/questions/499591/are-https-urls-enc...
That's incorrect. The URI library will parse the URL into a hostname, username, and password. Only the hostname is sent to the DNS server.
The username and password are sent in the "Authorization" HTTP header, which will be encrypted.