We are using asp.net mvc, using forms authentication. Username and password is sent to the server with TLS with a strong secure certificate. Their justification for this:
threat: "the web server uses plain-text form authentication. if an attacker with access to network traffic to and from target host may be able to obtain login credfentials by sniffing network traffic."
This is a problem for any website, and imo sounds like a waste of time. I tried to find justification for doing this. The best answer i found was on here:
basically its not worth it and can do more harm then good. Can anyone elaborate on the harm?
Because this is asp.net i think i will have to write a custom authentication module like here:
imo i think this introduces more risk than benefit. i.e. the module not working in some edge case scenarios. What do you think? Any other risks that im not thinking of?