Password is sent in clear text in login page #14876

ramup1717 · 2022-10-13T10:51:21Z

ramup1717
Oct 13, 2022

Dear Team,
In one of our project we are using keycloak18 for user authentication. we have submitted our application for VAPT. audit team raised a concern on password is in clear text and it should be encrypted. So kindly guide us how to resolve this issue. Even we tried solution mentioned in "https://github.com/edwin/keycloak-password-encryptor" url. we are unable to see the Custom SPI in admin authentication workflow after keeping custom Jar in deployments folder. kindly help us in this regard.

Thanks

Answered by sschu

Oct 13, 2022

The password is stored hashed and salted by default. If you have enabled TLS (which is required for production use), the password is also transferred encrypted. Keycloak TLS setup is explained here: https://www.keycloak.org/docs/latest/server_installation/#_setting_up_ssl

View full answer

sschu · 2022-10-13T16:39:30Z

sschu
Oct 13, 2022
Collaborator

The password is stored hashed and salted by default. If you have enabled TLS (which is required for production use), the password is also transferred encrypted. Keycloak TLS setup is explained here: https://www.keycloak.org/docs/latest/server_installation/#_setting_up_ssl

1 reply

ramup1717 Oct 25, 2022
Author

thank you.

Navigation Menu

Repository navigation

Password is sent in clear text in login page #14876

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Password is sent in clear text in login page #14876

Uh oh!

ramup1717 Oct 13, 2022

Replies: 1 comment · 1 reply

Uh oh!

sschu Oct 13, 2022 Collaborator

Uh oh!

ramup1717 Oct 25, 2022 Author

ramup1717
Oct 13, 2022

Replies: 1 comment 1 reply

sschu
Oct 13, 2022
Collaborator

ramup1717 Oct 25, 2022
Author