Are Bearer token hidden over https calls to a REST endpoint

user_16041057 0
Viewed 411

So I'm working on a application where a access tokens(JWT,Using spring security) is used authenticate a user the tokens are encrypted and stored in a httponly cookie (ngx-cookie) and the access token has validity of 24hrs and a new token is issued if expired ,currently I'm working on localhost and the bearer token is visible in the headers in the network tab whenever I make an api call. My question is when the application is live and over https(SSL) will the headers and the payload data will be still visible or hidden/encrypted ?

Currently new to programming so any guidance will be very helpful.

Bearer tokens are shown only for failed api calls not sure how and why

enter image description here

jwt angular spring-boot
1 Answers

TLS (Transport layer security, earlier SSL) is the protocol responsible for handling HTTPS. In OSI reference model, TLS protocol applies to transport layer (layer 4), while HTTP protocol is an application layer (layer 7) protocol (headers are part of HTTP protocol).

Note: OSI model is a reference model while the actual implementation is the IP model which is a simplified version of the OSI mode.

In communication, data from a given layer is encapsulated/wrapped by the layer below that before sending (read more about the OSI reference model). Therefore, your HTTP data (data + headers) will always be encrypted by the transport layer with the TLS protocol when HTTPS is enabled. Therefore, your application data, including HTTP headers/body will always be encrypted before it's sent over the network. Therefore, no need to worry.

user_40120730
Related