The question whether SSL/TLS is used for maintaining data confidentiality, is actually not as straight-forward as one might think. It depends.
We might disregard the deprecated SSL cipher suites that provided authenticity and integrity with a NULL bulk encryption algorithm. Even if you only take the cipher suites that do encrypt the bulk contents into consideration, that doesn't necessarily mean you get confidentiality.
The reason is quite simple: A SSL/TLS server might allow anonymous clients to connect. If anyone is allowed to connect and download the contents, the contents aren't very confidential, are they?
Consequently:
- SSL/TLS will typically not protect the confidentiality of the data provided by the server. It is not enough to slap SSL/TLS on a server, to ensure that only authorized clients will get access to the contents published by the server.
- SSL/TLS will however protect the confidentiality of the data provided by the client. Once the client has authenticated the server identity and established an authenticated and encrypted channel, no one but the server will be able to read the contents of the communication. This includes any authentication tokens the client might want to provide to the server to authenticate itself.
Hence, you will only get confidentiality in both directions (client to server as well as server to client) only once the client has authenticated itself to the server.