Is AJAX request from localhost to an HTTPS destination is securely encrypted? - ajax

Question

Maybe it is incorrect, but this is not a tutorial or something, its a question. So if it is incorrect, please correct it.
Situation:
Sending data from client side to server side using GET / POST / PUT / DELETE.
**
Here there is just another AJAX request as described above using the POST method with jQuery and AngularJS:
$.ajax({
type: "POST",
headers: {
"Content-Type": "application/json"
},
url: "https://www.myawesomedomainname.com",
data: JSON.stringify($scope.fetchData),
success: function(response) {
// some code
},
error: function(err) {
// some code
}
});
The security problem:
One can use the same Internet Wifi and since the data is not ecrypted, one can see the data transferred to the server. This security issue called: "Man in the middle".
The solution:
Working with HTTPS to encrypt the transferred data from client side to server side, will let the man in the middle see just bla bla bla.
The problem:
If we want the described above to work, both client side and server side have to know the encryption keys, otherwise, the targeted server will get the data encrypted too (like the man in the middle).
Not everytime we have that privilege - sometimes the client side does not own any kind of domain - maybe it is a mobile application?
The question:
When I am sending, lets say, from cordova mobile app, data to server side, which the server side has HTTPS url, does it securely encrypted and prevents man in the middle attacks?

Answer 1

When using HTTPS the entire request including other than the host address in the URL is encrypted. That includes the query string and server path.
Essentially MiTM attacks are prevented with only a very small attack surface by a very sophisticated and dedicated network attacker or an attacker that has physical access to the client device such as the device owner. That can be closed by pinning the certificate. This is generally not required.
Pinning the certificate means the client verifying that the certificate is the correct server certificate by comparing all or a portion of the certificate against compiled-in information. Many networking APIs contain pinning support.