5

i have a question if using SSL will encrypt both the query string and the Post request body which contain the fields values ?

and if the answer is yes,,

Then does this mean that i can be 99% confidence than an attaker will not be able to modify both the query string & the post body request?

BR

McGarnagle
  • 101,349
  • 31
  • 229
  • 260
John John
  • 1
  • 72
  • 238
  • 501
  • possible duplicate of [With HTTPS, are the URL and the request headers protected as the request body is?](http://stackoverflow.com/questions/8858102/with-https-are-the-url-and-the-request-headers-protected-as-the-request-body-is) – Bruno Apr 25 '12 at 09:15

2 Answers2

2

Then does this mean that i can be 99% confidence than an attaker will not be able to modify both the query string & the post body request?

SSL only encrypts and hide the information from a third party. However the hackers own request he can do whatever he wants with them, even if they are sent encrypted. As I said SSL only protects against a third party, not anything else.

A golden rule in all web development is, NEVER trust input data, Encrypted or not.

even if the attacker is Authenticated using a username and password to my web site.

The hacker can send whatever he see fit to the server, his request will be encrypted and protected against a third party, but he can send just whatever he want and your code, if you do not folow the line of never trust input data, he might breach into your server yeah.

So yet again SSL ONLY protects against a third party ( and even that some times not )

President James K. Polk
  • 40,516
  • 21
  • 95
  • 125
Tenerezza
  • 394
  • 1
  • 6
0

If you're using SSL, then yes, you can be sure an attacker will not be able to modify the query string or post data. SSL authenticates the server to the client to prevent anyone successfully impersonating your server. It also encrypts each message sent back and forth using the server's private X.509 key, so that no intermediary can decipher them.

McGarnagle
  • 101,349
  • 31
  • 229
  • 260
  • even if the attacker is Authenticated using a username and password to my web site. – John John Apr 25 '12 at 03:19
  • Yes. The reason is that the authentication happens for each session between the server and a single client. So even an authenticated attacker wouldn't have access to communications between the server and other users. – McGarnagle Apr 25 '12 at 03:33
  • @dbaseman: correct on what's encrypted; however messages are not encrypted with the server's private key but with a shared key negotiated as part of the handshake. – Bruno Apr 25 '12 at 09:18