HTTPS encrypts all message contents, including the HTTP headers and also the request/reaction details. Apart from the attainable CCA cryptographic attack described in the limitations part under, an attacker really should at most give you the option to discover that a connection is going down amongst two events, as well as their domain names and IP