HTTPS - Is Web Request and response are got Encrypted?

Maddy :

Am making webservice calls to HTTPS server from an android application. Below is the code snippet, with which am able to make web service calls successfully and getting response.

My Question is, do we need to perform any additional step to encrypt data before making call to HTTPS server? Because, from android profiler am able to see all my Web Requests in plain text format. My understanding is that request will gets encrypted before making HTTPS call.

     public static WebServiceResp makeWebServiceCall(String XML, String urlPath) throws IOException{
    //Code to make a web service HTTP request
    String responseString = "";
    String outputString = "";
    String wsURL = urlPath;
    URL url = new URL(wsURL);
    URLConnection connection = url.openConnection();
    HttpsURLConnection httpConn = (HttpsURLConnection)connection;
    ByteArrayOutputStream bout = new ByteArrayOutputStream();


    //System.out.println(XML);

    byte[] buffer = new byte[XML.length()];
    buffer = XML.getBytes();
    bout.write(buffer);
    byte[] b = bout.toByteArray();
    // Set the appropriate HTTP parameters.
    httpConn.setRequestProperty("Content-Length",
                                String.valueOf(b.length));
    httpConn.setRequestProperty("Content-Type", "text/xml; charset=utf-8");
    httpConn.setRequestMethod("POST");
    httpConn.setRequestProperty("Cache-Control", "no-cache");

    httpConn.setDoOutput(true);
    httpConn.setDoInput(true);


    OutputStream out = httpConn.getOutputStream();
    //Write the content of the request to the outputstream of the HTTP Connection.
    out.write(b);
    out.close();
    //Ready with sending the request.

    //Check the status
    int status = httpConn.getResponseCode();
    Log.d(TAG, "makeWebServiceCall: "+"Processing Status: "+status);


    BufferedReader in;
    if (status <= 200) {
        //Read the response.
        Log.d(TAG, "makeWebServiceCall: Getting Input Stream");
        InputStreamReader isr =
                new InputStreamReader(httpConn.getInputStream());
        in = new BufferedReader(isr);
    }else{
        //Read the response.
        Log.d(TAG, "makeWebServiceCall: Getting Error Stream");
        InputStreamReader isr =
                new InputStreamReader(httpConn.getErrorStream());
        in = new BufferedReader(isr);
    }

    //Write the SOAP message response to a String.
    while ((responseString = in.readLine()) != null) {
        outputString = outputString + responseString;
    }
        Log.d(TAG, "makeWebServiceCall: WebServiceResponse " + outputString);
        //Parse the String output to a org.w3c.dom.Document and be able to reach every node with the org.w3c.dom API.
        Document document = Utils.parseXmlFile(outputString);
        //NodeList nodeLst = document.getElementsByTagName("GetWeatherResult");
        // String weatherResult = nodeLst.item(0).getTextContent();
        //System.out.println("Weather: " + weatherResult);

        //Write the SOAP message formatted to the console.

    WebServiceResp webServiceResp = new WebServiceResp();
    webServiceResp.setDocument(document);
    webServiceResp.setStatus(status);
    return webServiceResp;

}

Gabe Sechan :

No. If you're sending it to an https website, the encryption is done as part of the protocol. You don't need to do any additional work.