Actions
Task #70214
closed
rsaauth should not send hashed password hash to formengine
Start date:
2015-09-30
Due date:
% Done:
0%
Estimated time:
TYPO3 Version:
7
PHP Version:
Tags:
Complexity:
Sprint Focus:
Description
Currently, the hashed password is transmitted to the browser, when a beuser is edited.
This is necessary, as otherwise the current password would be overwritten.
In my opinion it is a bad practice to send (even a hashed) password around. Data should only flow in one direction, from the browser to the server.
Updated by Martin Kutschker about 9 years ago
Yes, password equivalents should not be transmitted (insecurely) without a good reason.
Updated by Helmut Hummel almost 9 years ago
- Project changed from 1716 to TYPO3 Core
can safely be handled in public tracker
Actions