A third-party that is monitoring traffic may also be able to determine the page visited by examining your traffic an comparing it with the traffic another user has when visiting the site. For example if there were 2 pages only on a site, one much larger than the other, then comparison of the size of the data transfer would tell which page you visited. There are ways this could be hidden from the third-party but they're not normal server or browser behaviour. See for example this paper from SciRate, https://scirate.com/arxiv/1403.0297.

一般来说，其他答案是正确的，但实际上，这篇论文表明，可以相当有效地确定访问的页面(即URL)。

链接到我对重复问题的回答。URL不仅在浏览器历史记录中可用，服务器端日志也可以作为HTTP Referer头发送，如果您使用第三方内容，则会将URL暴露给您控制之外的来源。

虽然这里已经有了一些好的答案，但大多数都集中在浏览器导航方面。我在2018年写这篇文章，可能有人想知道移动应用程序的安全性。

对于移动应用程序，如果你控制应用程序的两端(服务器和应用程序)，只要你使用HTTPS，你就是安全的。iOS或Android将验证证书并减轻可能的MiM攻击(这将是所有这一切中唯一的弱点)。您可以通过HTTPS连接发送敏感数据，这些数据将在传输过程中被加密。只有你的应用程序和服务器会知道通过https发送的任何参数。

这里唯一的“可能”是客户端或服务器感染了恶意软件，可以在数据被包装成https之前看到数据。但如果有人感染了这种软件，他们就可以访问数据，不管你用什么来传输数据。

是的，SSL连接是在TCP层和HTTP层之间。客户端和服务器端首先建立一个安全的加密TCP连接(通过SSL/TLS协议)，然后客户端通过加密的TCP连接发送HTTP请求(GET, POST, DELETE…)

但是请注意(在评论中也提到了)，URL的域名部分在TLS协商的第一部分以明文形式发送。因此，可以嗅出服务器的域名。但不是URL的其余部分。

You can not always count on privacy of the full URL either. For instance, as is sometimes the case on enterprise networks, supplied devices like your company PC are configured with an extra "trusted" root certificate so that your browser can quietly trust a proxy (man-in-the-middle) inspection of https traffic. This means that the full URL is exposed for inspection. This is usually saved to a log. Furthermore, your passwords are also exposed and probably logged and this is another reason to use one time passwords or to change your passwords frequently. Finally, the request and response content is also exposed if not otherwise encrypted. One example of the inspection setup is described by Checkpoint here. An old style "internet café" using supplied PC's may also be set up this way.

Marc Novakowski的回答很有帮助——URL存储在服务器的日志中(例如，在/etc/httpd/logs/ssl_access_log中)，所以如果你不想让服务器长期保存这些信息，就不要把它放在URL中。