I’m creating a small windows application that will use Discourse as the SSO provider. The first step in that chain is allowing the app to create a user through the Discourse API. I’ve got that working, however it seems that the password for the user is passed in plain text and I’m wondering why tha…

Yes, SSL is considered sufficient to protect secrets in-flight. Until the world sees the light and switches to something like TLS-SRP, sharing secrets over a secured channel are pretty much all we’ve got to work with.

Can we send encrypted password instead of plain text password ?

is there any way to pass an encrypted password instead of plain text password ? we are developing one app in which we are using /session api for checking authentication of the user. where username and password need to be submitted. i noticed one thing that lets say if you go to browsers developer t…

If SSO is enabled, the password is not being used at all, so this is not an issue. Just provide some random characters.

if you want to go the extra mile, you can do certificate pinning in your APP to make sure there is no man in the middle attack.

[이미지] Siddhu_Dhangar: is there any way to pass an encrypted password instead of plain text password ? As long as you’re using TLS, passwords are sent encrypted. If you’re not using TLS, you’re on a fast train to doom regardless. If you meant “hashed” rather than “encrypted”, then no, that i…

Should the password be plain text when creating a user through the API?

Development

RGJ (Richard - Communiteq) 6월 16, 2020, 2:16오후 5

SSO가 활성화되어 있으면 비밀번호는 전혀 사용되지 않으므로 이는 문제가 되지 않습니다.
임의의 문자열을 입력하면 됩니다.

글		댓글	조회수
SMTP Password saved as plain text? Self-hosting	6	1546	3월 15, 2020
Use discourse for SSO in a non-web app? Development	12	4930	8월 5, 2022
Adding SSO after many users already signed up -- how to migrate them? SSO	17	1894	9월 11, 2022
Password verification via REST API SSO	1	1703	10월 11, 2016
Is it Possible to Send Encrypted Email and Password in the Authentication Flow? Development	1	146	7월 21, 2025

Should the password be plain text when creating a user through the API?

Related topics