• bleistift2@feddit.de
    link
    fedilink
    arrow-up
    23
    ·
    1 year ago

    cleartext usernames and passwords as the URI components of GET requests

    I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?

    • nudelbiotop@feddit.de
      link
      fedilink
      arrow-up
      31
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.

    • rtxn@lemmy.world
      link
      fedilink
      arrow-up
      10
      ·
      1 year ago

      Nope, it’s bare-ass HTTP. The server software also connected to an LDAP server.

    • ItsMyFirstDay@lemmy.world
      link
      fedilink
      arrow-up
      10
      ·
      1 year ago

      I’m not 100% on this but I think GET requests are logged by default.

      POST requests, normally used for passwords, don’t get logged by default.

      BUT the Uri would get logged would get logged on both, so if the URI contained @username:Password then it’s likely all there in the logs

      • bleistift2@feddit.de
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        GET requests are logged

        That’s why I specified

        the receiving web server doesn’t log the URI

        in my question.

      • SzethFriendOfNimi@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Get and post requests are logged

        The difference is that the logged get requests will also include any query params

        GET /some/uri?user=Alpha&pass=bravo

        While a post request will have those same params sent as part of a form body request. Those aren’t logged and so it would look like this

        POST /some/uri

    • netvor@lemmy.world
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      I would still not sleep well; other things might log URI’s to different unprotected places. Depending on how the software works, this might be client, but also middleware or proxy…

    • Archer@lemmy.world
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      supposing the communication is encrypted with TLS

      I can practically guarantee you it was not

    • nijave@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Browser history

      Even if the destination doesn’t log GET components, there could be corporate proxies that MITM that might log the URL. Corporate proxies usually present an internally trusted certificate to the client.