Web Connect logging user names and passwords in plaintext.

FreeRDP / FreeRDP-WebConnect

A gateway for seamless access to your RDP-Sessions in any HTML5-compliant browser

519 stars 1.62k forks source link

Web Connect logging user names and passwords in plaintext. #83

Open Andrew-Precht opened 10 years ago

Andrew-Precht commented 10 years ago

Hi all, I was looking over the application logs on the Server 2012 that I have Web Connect installed on. I noticed that user names and passwords are being logged in plaintext. This can't be by design?

Andrew-Precht commented 10 years ago

It is Version 1.2.0.320 installed on Server 2012 R2. debug is set to false. If there is anything I can do to help troubleshoot this, please let me know...

webnew commented 9 years ago

I think the reason is that user and password are sent by GET in the URL. See issue #99 that I just opened. User and password are also in the browser log/history. So everybody with access to the browser is able to get user and and password.