I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers.

However if I REALLY need to use JSONP to submit a username and password to my server, is there a way to do it?

Maybe some crypto on the back-end and front-end?

I was just trying to have a simple approach to get my users to login to two domains (not sub-domains) at the same time, without breaking CORS rules. Basically, what I get in my logs now is this

GET /login/jsonp?callback=jQuery21403191181201609543_1535388742134&email=email%40gmail.com&password=SjRrNOHzN&_=1535388742135 200 32.987 ms - 130.

I believe such query is not secure.

  • "because the query string can be logged by multiple eavesdroppers" if you are using HTTPS which eavesdroppers do you think about? The query string in the GET part will be encrypted as much as the POST content would be, so no differences there. You can however argue that for example it would be bad for logging since often the whole URL is logged. – Patrick Mevzek Aug 27 '18 at 18:31
  • @PatrickMevzek Not sure, I was thinking about my CDN, and also browser add-ons. People here seem to agree that password over GET (even with https) is not safe: security.stackexchange.com/questions/38688/… security.stackexchange.com/questions/30976/… There's also the issue that I would need to remove the sensitive data from my logs. – Emilio Aug 27 '18 at 18:35
  • If the CDN ends the TLS connection, of course it can inspect all HTTP trafic, GET or POST. As for browser add-ons they will also get access, in some way to all GET and POST data, so I fail to see differences there. The first link you give gives exactly same info as my comment above (same encryption, difference in logging often of course), second one speaks about Session Fixation which is an orthogonal problem to HTTPS. – Patrick Mevzek Aug 27 '18 at 18:40
  • @PatrickMevzek I guess the worry would be that the CDN and the browser add-ons are known to log the query string of the requests; however they rarely log the body. / I'm thinking maybe that masking the password with a little bit of crypto using something such as the CSRF token for the key would be a solution for that. What do you think? – Emilio Aug 27 '18 at 18:44
  • 1
    Why use JSONP instead of CORS with a POST request? JSONP is just an old hack that is unnecessary with CORS support being universal now. – Macil Aug 27 '18 at 20:22

JSONP is usually used with a server sending data to a client, wrapped in a function call which gets executed on the client by javascript. Sending data to a server does not require JSONP, it just requires a normal HTTP request.

You should definitely not use the GET method for submitting username + password pairs. Secondly your response from the server should not include the login credentials themselves; the sensitive login data should only go one direction (from the client to the server) and never be reflected back. What I would suggest is two asynchronous calls, one to each server. You probably want to do this in parallel, rather than one after the other, using Promises. Then if both promises resolve and both servers indicate successful login, send back session id's or tokens in the response from each server.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.