Can SSL connection send my IP address to the host?

Question

I don't have enough information about the difference between HTTP and HTTPS, but can an HTTPS request send my IP address to the host and store it?

What are the kinds of data that are being encrypted?

Answer 1

You'll always have to send your IP address for ANY traffic over the internet (IP = internet protocol). It is possible to spoof IP addresses for single-direction UDP traffic, but most ISPs should filter this. It is not possible to establish a TCP connection without sending the correct source address and SSL is based on TCP.

As its name sugests, SSL (Secure Socket Layer) works on the "socket" layer. This means, all that is transmitted in plain (apart form some initial security handshake) is the IP addresses and ports of the source and destination and some TCP session data.

Answer 2

By virtue of you making a connection to a remote host, the remote host knows your IP. It has to in order to send you responses from the server.

Since most of the time you are accessing a host via a URL, a DNS lookup has to be performed. The DNS server also has to know your IP address and may be recording or tallying the exact domain name you were causing to be looked up.

If you are behind a NAT, the server knows only your external IP unless your traffic is being run through a web proxy that adds your internal IP as a line in the HTTP header. A well known caching Web proxy squid does this, for example, unless you configure it not to.

And of course, if you (or another program using HTTPS) are willfully sending your IP address as part of an HTTP request, i.e. posting it to a form and it's in the POST data, then of course that's another way the server could know.

In HTTPS all data is encrypted, header and body, and your requests to the server are also fully encrypted, which would include the exact URL. The Wikipedia article about HTTPS details many of the "side channel" type attacks that could reveal interesting information to a determined intercepting attacker.