search

jmapio / jmap-demo-webmail

Demo JMAP Webmail Client
MIT License
103 stars 20 forks source link

A better secured auth method? #14

Closed s77rt closed 4 years ago

s77rt commented 4 years ago

Hi,

How can we authenticate to a jmap server in production ?

The current implemented auth method is far away from being a secure one. The password is fully stored in plaintext and it also can be access with App.credentials.password

neilj commented 4 years ago

That depends on the JMAP server. Authentication is not part of the JMAP standard; it's standard HTTP authentication. As a basic demo, this webmail builds in support for HTTP Basic Auth; this requires storing the password to work.

s77rt commented 4 years ago

@neilj I can't find much docs about the JMAP server Can you attach some links?

neilj commented 4 years ago

It depends which server you are talking to; you will need to consult the documentation of the service or server you are using.