Is it an issue to send back the same sensitive (PCI, PII) information from the server in the HTML reply that a user previously posted to the server?
On our webpage, the user enters some key info (name/address/card/account number/etc.), which is then posted to our server and we send back a page containing some non-sensitive details (dates, account balance, etc.) along with the key info he/she just provided, so that the user can further change some key values to alter the search.
POST to the server:
Reply from the server:
<html> ... <input name="cardNumber" value="1111222233334444" ... /> Here are some details about your card... </html>
The website has recently undergone a security assessment where the reviewer flagged this behavior as a high priority vulnerability, that we should not send back any sensitive info unmasked in the HTML response from the server (
value="111122223333444" in the above example). They mentioned MITM attack, where somebody can steal sensitive info from the HTML data.
The developers challenged this saying the MITM can steal data from both ways of traffic, so the MITM could steal the data from the POST message and the server is not sending back more sensitive data than what was sent to the server originally. And they provided some network trace showing some well known websites on the internet also doing this practice.
Who is right: the security reviewer or the developers, and why?
Note the website is accessible only over HTTPS and other security measurements (cache control, page expiration, etc.) also implemented.