Hacker News new | past | comments | ask | show | jobs | submit login

Ah yes, apologies. Again, it's not strictly part of the HTTP request, but part of the TLS handshake around it. And only part of the TLS handshake as part of SNI, if supported (which is true by default).

> "Server Name Indication payload is not encrypted, thus the hostname of the server the client tries to connect to is visible to a passive eavesdropper."

https://en.wikipedia.org/wiki/Server_Name_Indication

So you're right, this is more aligned to the HTTP request than the DNS resolution of hostname that I mentioned. Strictly speaking, it's not part of HTTP per se (it's part of TLS), but still, it's in the same request in the most common definition, as you are saying.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: