HTTPS - iPhone to API - Is URL secure?

Question

I understood that when securing your site through HTTPS, the URL including the query string is encrypted and only sent once connection is made to the host so this url isnt available to eaves droppers.

However, someone has told us that this is not the case, at least in the case of iPhone to .Net (MVC) API connection and he recommended adding this sensitive information to the HTTP header.

So, can we rely on the query string being encrypted or is it best to change how we're working and add it to the header as suggested?

Answer 1

Any HTTPS connection works the same way:

1. Client connects to port 443 (usually, can be a different port if specified in URL) on the server, establishes a TLS session
2. Inside the TLS session, do HTTP: send command ("GET"), query string, HTTP Headers, and get a response

The only thing that's unencrypted is a DNS lookup of the hostname of the server, and then the connection to the server's IP address. Everything else is secure.

NOTE: this assumes you don't have a proxy doing stupid stuff in the middle.