How to protect password to display in HttpRequest in asp.Net

Question

0.00/5 (No votes)

See more:

I am working in a project in which our clients wants to protect the LoginPage password during postback. At first I thought it is due to ViewState, so I added the following config under system.web

XML

<pages enableEventValidation="false" enableViewStateMac="true" viewStateEncryptionMode="Always"  controlRenderingCompatibilityVersion="4.0">

But even then, when I have a look into the HTTP headers, my password is visible very clearly (refer the link below)
http://www.sharexfiles.com/image/2015-02-17_153654.jpg

Is there is anyway we can encrypt the password on the client side while the Login Request?

In our project we use https, even then I can see the password clearly as given in the link. Is there is any way can we protect this password?

Posted 22-Feb-15 23:45pm

Prasaad SJ

Updated 22-Feb-15 23:52pm

Joezer BH

v2

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

**Joezer BH** · Answer 1 · 2015-02-22T23:56:00

Solution 1

My advice is: Use SSL[^].

Cheers,
C

(there's a good reason why everyone is doing it...)

Posted 22-Feb-15 23:56pm

Joezer BH

Updated 23-Feb-15 0:48am

v3

Comments

Kornfeld Eliyahu Peter 23-Feb-15 6:04am

You better use TLS, me think... (and the link is broken)

Joezer BH 23-Feb-15 6:49am

fiCSed

Kornfeld Eliyahu Peter · Answer 2 · 2015-02-22T23:56:00

Solution 2

Protect against what? Man-in-the middle?
Use HTTPS (preferably with TLS) and only the two ends (client and server) will be able to see the password as plain text...

Posted 22-Feb-15 23:56pm

Kornfeld Eliyahu Peter

Comments

Prasaad SJ 23-Feb-15 23:10pm

Hi Kornfield, More like Man in the Middle or any attacker technique. You can have a look at the following links, Before using enableViewStateMac="true" viewStateEncryptionMode="Always" : http://www.sharexfiles.com/image/2015-02-24_113847_0.jpg. After using : http://www.sharexfiles.com/image/2015-02-24_114302.jpg. In the above you could see the Block in Red remains unchanged. My concern is will that be explicit when the request goes from one point to the other and can we secure this password (block in red) in any way?

Kornfeld Eliyahu Peter 24-Feb-15 1:22am

As I told you already, use HTTPS (and yes Fiddler running on the same machine is like the browser itself - it has nothing to do with the actual encryption...)!!!
All those view-state flags are not for encryption, but to ensure that the origin of the request not faked...