5

I am logging in to my site using Chrome (on Ubuntu). Even if I logout and close my browser I can see the login POST request content (containing username and Password) using "Hexedit".

I have seen a similar question asked for IE, but I am not convinced with the answers provided. Most of them sounds like precautions only. I searched online for solutions. Someone suggested to use encryption on the client side, but that isn't a solution I can easily go for.

Gmail and Facbook login are not using any client side encryption (I can see my username and password sent in POST request without encryption); But I can't see any POST request saved for Gmail and Facebook using "Hexedit". So I suppose there is something that can be done?

How do I stop browsers (not just Chrome, but in general) from saving the content of POST requests sent to my site?

  • Is there any way to prevent browser (Any not only Chrome) storing login POST request in its memory. Generally browser stores POST requests on hex format which can be accessed using Hex editors like "Winhex" in Windows or "Hexedit" in Linux. There is a siliar question asked for IE as well – Moolshankar Tyagi Mar 27 '17 at 7:18
  • Anyway for the user visiting the site to stop it from being stored? Or anyway for the owner of the server thats serving the site? – Anders Mar 27 '17 at 7:24
  • anyway for the owner of the server thats serving the site. I am a developer and this is a security vulnerability in my code for which I need to fix. – Moolshankar Tyagi Mar 27 '17 at 7:28
  • 2
    right, that's what I mean: you want your server to tell a client browser to modify its internal memory cache .... I'm not sure you will find any function to permit this ... – schroeder Mar 27 '17 at 10:57
2

You don't really have to worry about this. You aren't responsible for managing the virtual memory of a client's browser.

Think through what you're concerned about. The only way for this to be exploited is for an attacker to be on a client's machine, and to dump the memory of the process. If this is the case, they already have multiple easier methods of harvesting credentials (keylogging, browser Man-in-the-middle, etc...).

If you really wanted to get crazy about it, I suppose you could do something like this:

  • Separate the 'password' field into multiple different form elements spread around the page
  • Assign each character to a different variable in the POST request
  • Send all the characters in different order and reassemble on your side

I don't 100% know if that'll work, but I don't think it'll be easily readable in memory without some manual extraction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.