0

I have one bugzilla setup working with me. I have hosted the same on apache. When we login to bugzilla, it sends the POST request Form Data which has password as plain text.

Form Data:

Bugzilla_login:[email protected]

Bugzilla_password:test

Bugzilla_login_token:

GoAheadAndLogIn:Log in

I feel this is risky and will adhere the security policies.

Is there any way to hide this plain text password?

Thanks!!

Improve this question
1

1 Answer 1

Reset to default
0

The best practice here is to use HTTPS. Let's Encrypt just recently came out with some pretty options if you're looking for where to start. If you look at Developer Tools in browser and log into your favorite site, a lot of sites send their passwords unencrypted with the overall traffic being encrypted over HTTPS nowadays.

Also note when you setup HTTPS you need to make sure you're signing it/not using old cipher suites/etc. Cheap dirty shortcut is if you go in browser and get the old "big red X" over your HTTPS connection try to understand why and if it has actual implications on the integrity of your communications.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .