0

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers.

However if I REALLY need to use JSONP to submit a username and password to my server, is there a way to do it?

Maybe some crypto on the back-end and front-end?

I was just trying to have a simple approach to get my users to login to two domains (not sub-domains) at the same time, without breaking CORS rules. Basically, what I get in my logs now is this

GET /login/jsonp?callback=jQuery21403191181201609543_1535388742134&email=email%40gmail.com&password=SjRrNOHzN&_=1535388742135 200 32.987 ms - 130.

I believe such query is not secure.

12
  • "because the query string can be logged by multiple eavesdroppers" if you are using HTTPS which eavesdroppers do you think about? The query string in the GET part will be encrypted as much as the POST content would be, so no differences there. You can however argue that for example it would be bad for logging since often the whole URL is logged. Aug 27, 2018 at 18:31
  • @PatrickMevzek Not sure, I was thinking about my CDN, and also browser add-ons. People here seem to agree that password over GET (even with https) is not safe: security.stackexchange.com/questions/38688/… security.stackexchange.com/questions/30976/… There's also the issue that I would need to remove the sensitive data from my logs.
    – Emilio
    Aug 27, 2018 at 18:35
  • If the CDN ends the TLS connection, of course it can inspect all HTTP trafic, GET or POST. As for browser add-ons they will also get access, in some way to all GET and POST data, so I fail to see differences there. The first link you give gives exactly same info as my comment above (same encryption, difference in logging often of course), second one speaks about Session Fixation which is an orthogonal problem to HTTPS. Aug 27, 2018 at 18:40
  • @PatrickMevzek I guess the worry would be that the CDN and the browser add-ons are known to log the query string of the requests; however they rarely log the body. / I'm thinking maybe that masking the password with a little bit of crypto using something such as the CSRF token for the key would be a solution for that. What do you think?
    – Emilio
    Aug 27, 2018 at 18:44
  • 1
    Why use JSONP instead of CORS with a POST request? JSONP is just an old hack that is unnecessary with CORS support being universal now.
    – Macil
    Aug 27, 2018 at 20:22

1 Answer 1

1

JSONP is usually used with a server sending data to a client, wrapped in a function call which gets executed on the client by javascript. Sending data to a server does not require JSONP, it just requires a normal HTTP request.

You should definitely not use the GET method for submitting username + password pairs. Secondly your response from the server should not include the login credentials themselves; the sensitive login data should only go one direction (from the client to the server) and never be reflected back. What I would suggest is two asynchronous calls, one to each server. You probably want to do this in parallel, rather than one after the other, using Promises. Then if both promises resolve and both servers indicate successful login, send back session id's or tokens in the response from each server.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .