I have one bugzilla setup working with me. I have hosted the same on apache. When we login to bugzilla, it sends the POST request Form Data which has password as plain text.

Form Data:




GoAheadAndLogIn:Log in

I feel this is risky and will adhere the security policies.

Is there any way to hide this plain text password?



The best practice here is to use HTTPS. Let's Encrypt just recently came out with some pretty options if you're looking for where to start. If you look at Developer Tools in browser and log into your favorite site, a lot of sites send their passwords unencrypted with the overall traffic being encrypted over HTTPS nowadays.

Also note when you setup HTTPS you need to make sure you're signing it/not using old cipher suites/etc. Cheap dirty shortcut is if you go in browser and get the old "big red X" over your HTTPS connection try to understand why and if it has actual implications on the integrity of your communications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.