Are the query string variables visible using a Response.Redirect between two Https pages?

Question

I'm looking at a web application with a Response.Redirect between two Https pages. I would assume normally that the query string parameters aren't visible for https requests because of the secure connection. However, since the Response.Redirect sends back the 302 - Object Moved response in between the two pages along with query string variables, I'm worried that this message is not encrypted at all.

I have looked at the data with HttpAnalyzer but I believe it unecrypts Https traffic automatically. Do I have the wrong idea about how Https requests work in general? If anyone has any advice on how to proceed with this, I'd appreciate it.

Answer 1

What do you mean by "visible"? To an intruder?

The host you're connecting to is visible in an unencrypted form, but not the full URL itself unless there's a man-in-the-middle attack (which requires the user to trust the attacker's certificate).

Answer 2

Although, query strings are not visible on the network with HTTPS, there are other concerns about where URLs containing query strings may be stored or transmitted:

http://blog.httpwatch.com/2009/02/20/how-secure-are-query-strings-over-https/