Customize passwords processing before sending request

akveo / ngx-admin

Customizable admin dashboard template based on Angular 10+

https://akveo.github.io/ngx-admin/

MIT License

25.21k stars 7.95k forks source link

Open diyfr opened 6 years ago

diyfr commented 6 years ago

I'm submitting a ...

Current behavior:
The password is visible in the calls

Expected behavior:
Add an method (config params ?) for customize password before send request (Hash, Salt etc....)

Steps to reproduce:
It is not advisable to transit and store the password in clear. See console network logs

nnixaa commented 6 years ago

Hi @diyfr, thanks for your suggestion. Though I'm not completely sure this makes much sense, as

hashing or salting of the password on a client-side could be easily decrypted, as client-code is available in the browser
to not pass passwords through the network we have HTTPS protocol which ensures the security of a connection

In any case, if you need to add an additional layer of processing you can use Angular HTTP Interceptors to be able to adjust requests before sending.

diyfr commented 6 years ago

This also allows to comply with the RGPD, and not store in the clear server side passwords :)