0

I did not like how my password and other credentials could be viewed in the browser developer console when passed from a form to my api authentication service. So I'm now base64 encoding using atob() before posting.

Am I too paranoid? Is there a better way?

Improve this question
5
  • 3
    Does this answer your question? How to avoid reveal password in a form?. In short: it does not help.
    – Steffen Ullrich
    Sep 28 at 5:07
  • When you call an auth api from a react or other single page app the form contents are sent over the 'wire' to the backend api. In the developer console the password will be clearly visible.
    – Martlark
    Sep 28 at 6:46
  • 2
    How does base64 encoding relieve your paranoia? It's as good as unencoded strings. Why is seeing it in the developer console a problem? What risk does that introduce?
    – schroeder ♦
    Sep 28 at 10:20
  • This would make sense if you're not using SSL/TLS, as it would (minimally) protect against network sniffers like wireshark, but since you're using SSL/TLS (right?), it's not really going to do anything helpful imho.
    – Adam Katz
    Sep 28 at 15:07
  • If I was debugging with a colleague they could not see my credentials, that's basically the use case.
    – Martlark
    Sep 29 at 3:55

1 Answer 1

Reset to default
1

The “browser console” is a debug and development tool which is designed to show anything you transmit over the line (among other things).

Having your password in a POST request in there is not really a problem. It’s basically as safe there as it was to enter it into the browser to begin with.

Using base64 will only slightly obfuscate your password. For anyone trying to get it from you it’s a non-barrier. So better to not use it.

What I would do is use established authentication techniques such as for example oauth 2 or OpenID Connect. These would mitigate much of the risks by using time limited tokens that are temper resistant through hashing and/or encryption.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .