I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server?

If I could see the password in plaintext using a tool like wireshark, does it mean that its because of poor implementation or its just the way JDBC works?

Can anyone give me an example with any db vendor? Say MySQL JDBC driver or Postgres JDBC driver?

  • 2
    It depends entirely on the JDBC provider you're using. The provider will implement a vendor-specfic protocol to talk to the database server. JDBC doesn't do anything except provide a programming interface behind which vendor code lurks. – Marquis of Lorne May 18 '16 at 5:48

JDBC is a Java API. It uses JDBC database drivers to actually communicate with database servers. These drivers may or may not support TLS.

The PostgreSQL JDBC driver supports TLS: https://jdbc.postgresql.org/documentation/94/ssl.html

So, it would connect to the database server using TLS, then send the username and password to authenticate. You would not be able to see the password using Wireshark.

PostgreSQL also supports "pass the (md5) hash" style authentication but it's not recommended. This would hash the password with md5 on the client and send it to the server.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.