Password is in plain text in ASP.Net Page submit.

Question

Hello,

 

In my web application, we are creating users using salt and hash technique with SHA256. we are able to login with the users created with the hash and Salt technique. All APS.Net controls are server side controls.

We approached a security audit team for any security issues.  When our  security auditor check the application using Burp Suite, they say that password is still in clear text. What they are saying is the encrypt the password before transmitting the data on to the server. The security testing on an http. we have a https also but they wanted to do the testing on http only. Would you please kindly let us know what is the approach that we need to follow? 

 

Thanks and Kind Regards,

Venkat.