We have our web app / REST API getting tested by potential customer. In the report they came up with this issue:
Sensitive data like user credentials on login page, password reset, change password etc. are sent in clear text format. If sent in clear text format attacker can steal those from the browsers memory.
And I am wondering whether it is time to dispute this as - obviously, since this is year 2021 - the connection is over HTTPS. They can see the credentials in the network tab of the browser console but it is the same bloody password they entered one sec ago and sent.
The recommendation is:
It is recommended to use hashing to send the credentials over the network. Strong hashing like SHA-256 should be used.
It seems like some dated info or test method used from the old days when https was rare.
As security professionals - what would you recommend? Should we cope with the requirement or should we dispute that it is unnecessary layer over HTTPS that is in place?
I am aware of questions (*) dealing with the topic itself and I am also aware that this might lead to opinionated answers. Still trying my luck as it seems a bit over the top. Thx.