1
Answer

Login Password visible on payload

Sushant Torankar

Sushant Torankar
Jul 01
529
1

hello,

My project is in Asp.net. VAPT team mentioned a point related to LOGIN page. I have Username and Password textbox on login.

Team said - password is visible when they do inspect element > Network>Payload. Please check attached screenshot.

I am already using encryption, but it is used to save plain text password in encrypted format in database, which is working.

but still password is visible under inspect element section

How to hide or encrypt-decrypt that password ony in inspect element section ?

 

Thank You

Answers (1)
1
Naimish Makwana

Naimish Makwana

134 13.8k 201.2k Jul 02

The issue you’re facing is a common one. When a user types their password into a form, it is sent to the server as part of the HTTP request. This is true regardless of whether you’re using a GET or POST request. The password will be visible in the browser’s developer tools under the Network tab, because these tools show the raw HTTP request data.

However, this doesn’t necessarily mean your application is insecure. The password is only visible to the person using the browser, not to anyone else. If an attacker has access to a user’s browser to the extent that they can inspect HTTP requests, the user has bigger problems than just their password being visible in the developer tools1.

That being said, it’s good practice to secure the password during transmission. Here are a few things you can do:

  1. Use HTTPS: This is the most important step. HTTPS encrypts the entire HTTP request, so even if someone is able to intercept the network traffic, they won’t be able to read the password2.

  2. Client-side hashing: You can hash the password on the client side before sending it to the server. This way, the password will not appear in plain text in the network payload. However, this is not a common practice because if the client-side code is compromised, an attacker could simply modify the code to capture the password before it’s hashed1.

  3. Use a secure password field: Make sure you’re using an <input type="password"> field for the password. This won’t hide the password in the network payload, but it will prevent the password from being visible on the screen3.

Remember, security is a multi-layered approach. While it’s good to secure the password in transit, it’s also important to secure the password at rest (in your database) and to protect against other types of attacks, such as cross-site scripting (XSS) and SQL injection12. 

Thanks

Next Recommended Forum