HTTPS encrypts all information contents, such as the HTTP headers as well as the ask for/reaction knowledge. Apart from the doable CCA cryptographic assault explained in the limitations part underneath, an attacker should really at most have the opportunity to discover that a connection is happening