Are browser cookies and other headers visible during HTTPS?

4
votes

When using a HTTPS connection are browser cookies and HTTP headers visible as plain text? That is, is only the body of the HTTP content encrypted?

2
https
possible duplicate of With HTTPS, are the URL and the request headers protected as the request body is? – Bruno

2 Answers

4
votes

Both the request and response are fully encrypted – so the cookies and all headers are protected. About the only thing visible to an external sniffer is the host and remote address (IP) that you're requesting.

1
votes

All https is http over an encrypted connection i.e. the contents of the TCP/IP packets are encrypted.