strict requirement, applications should use HTTPS (TLS) only. The TLS origination described in this
example would not be sufficient.</p><p>Also note that even with HTTPS originated by the application, an attacker could know that requests to <code>edition.cnn.com</code>
are being sent by inspecting <a href=https://en.wikipedia.org/wiki/Server_Name_Indication>Server Name Indication (SNI)</a>.
The <em>SNI</em> field is sent unencrypted during the TLS handshake. Using HTTPS prevents the attackers from knowing s