The whole connection is encrypted by https, the request body is treated the same as the url, the headers or the response. The only unencrypted parts are the IP addresses/ports and the domain name (if SNI without ECH is used).

CDNs already terminate TLS connections so they can cache GET requests.

I think a lot of people don’t know the http/1.x protocol from url (header) to body is a stream of text* separated by \r\n.

* the body may be compressed.

[flagged]