• Post Reply Bookmark Topic Watch Topic
  • New Topic

securing password in html form

 
Alex Kravets
Ranch Hand
Posts: 476
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I have a web application that manages users' information. One of the fields is a password field that can be viewed or changed. A user using this application can go from one record to another. Altough the input field is of type password and displays astericks when password is displayed, someone can view source and see the password. What the best way to secure the password? Should I encrypt the password before sending and decrypt it in the receving page?

thanks,
Alex
 
Bear Bibeault
Author and ninkuma
Marshal
Posts: 65530
108
IntelliJ IDE Java jQuery Mac Mac OS X
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
View source cannot show the password since the user typing into the field doesnt change the HTML source.

However, unless you are using a secure connection, the password will be passed over the net in clear text.
 
Ben Souther
Sheriff
Posts: 13411
Firefox Browser Redhat VI Editor
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
You should never send a password to a browser.
Just leave the field blank.
Put instructions on the page not to fill out that field unless the user wants
to change their password.

When you parse the form, check to see if the length of the passoword field is greater than zero.
If it is, update the password with the value from the page.
If not, leave the password field alone.

Either that or create a separate page for updating the password with 3 fields.
Old Password, new password, and new password confirm.
Again, it would be a write only form. Don't send the password to the browser.
 
Bear Bibeault
Author and ninkuma
Marshal
Posts: 65530
108
IntelliJ IDE Java jQuery Mac Mac OS X
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Don't send the password to the browser.


Definitely! If you do, then the password will be visible in the source.

Second the motion: don't do that!
[ May 24, 2005: Message edited by: Bear Bibeault ]
 
D Rog
Ranch Hand
Posts: 472
Linux Objective C Ubuntu
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
It's Ok to send a password to browser. When you use SSL your excgange is completly encrypted, so do the same with passwords.
 
Bear Bibeault
Author and ninkuma
Marshal
Posts: 65530
108
IntelliJ IDE Java jQuery Mac Mac OS X
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
He was worried about View Source, so even using SSL sending the password to the browser is unsafe. Don't do it.
 
Alex Kravets
Ranch Hand
Posts: 476
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Yeah, I actually did what Ben suggested (before reading the reply). I just display the password field blank and a note saying that this fields is not visible and should only be used to change the password. I also thought about encrypting password field with SHA-1 since it would display encryped values in the browser anyway, but in our database the password field is only 10 characters and SHA-1 would make it more like 20.

thanks a lot,
Alex
 
D Rog
Ranch Hand
Posts: 472
Linux Objective C Ubuntu
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Originally posted by Bear Bibeault:
He was worried about View Source, so even using SSL sending the password to the browser is unsafe. Don't do it.
Sorry my bad English. Anyway my Russian isn't better too. Yes, I meant encrypt password as SSL. OP consider it as an option and it seems to right move. Say more, we encrypt certain user profile data and store as cookie, it reduces number of database hits and keeps app secure.
 
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!