I just tried to reset my password on radioooooo.com.
I didn't really pay attention to firefox's warnings because I'm used to see them on our intranet at work, but I think that when clicking the "OK" button my password might have been transmitted in clear.
Here is what I did:
- Asked for a password reset
- Received a link by email to reset my password, that looks like this:
- Entered a new password
- Clicked OK, which seemed to have sent an OPTION and a POST to http urls
Here are the requests:
OPTIONS XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 200 OK 299ms] POST XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 404 Not Found 514ms]
I'm not familiar with Firefox's console but the POST does not seem to have a body, which makes me think my password was not actually sent. Here is the header:
Accept*/* Accept-Encoding gzip, deflate Accept-Language en-US,en;q=0.5 Connection keep-alive Content-Length 71 Content-Type application/json DNT 1 Host admin1.radiooooo.com Origin http://radiooooo.com Referer http://radiooooo.com/User-AgentMozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
And the response's header:
Cache-Control no-cache, no-store, max-age=0, must-revalidate Connection keep-alive Content-Encoding gzip Content-Type application/json;charset=UTF-8 Date Thu, 22 Mar 2018 19:22:36 GMT Expires 0 Pragma no-cache Servernginx/1.2.1 Transfer-Encoding chunked Vary Accept-Encoding X-Content-Type-Options nosniff X-Frame-Options DENY X-XSS-Protection1; mode=block