1

In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies?

This is relevant in case we have to deal with script injection and similar attacks.

According to this question the protection is done on the client-side and only protects against physical viewing of the password, is that correct? It's hard to tell from the lack of information and it is only a blind assumption.

P.S This question has nothing to do with locally stored passwords in the browser.

Improve this question
1
  • In fact, data in password fields is often sent over XHR, since many modern applications are heavily frontend.
    – multithr3at3d
    Nov 17, 2019 at 18:11

1 Answer 1

Reset to default
2

Using type="password" in HTML only prevents shoulder-surfing by obscuring the typed characters on the screen. The actual password is available to any code that can access the document object model, and, in the absence of a TLS connection, is sent to the server in the clear.

Although not directly related to the question, I have to add that "client-side encryption" is useless. The "encrypted" value is available through the DOM, and as far as the server is concerned, that is the password.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .