Secure URL passwords are displayed in clear text

Svend · Post by **Svend** » Thu Mar 06, 2008 6:22 pm

I have a test that checks an Open Mobile Access page on a server. This is a secure site that requires ID and password. I'm doing a URL Request.
After setting the ID and password in the test the URL to be tested then contains the password in this format...

https://userid:password@host.domain.com.au:80/oma

I'm a bit concerned that this test is even displaying the password. This has allowed other people who use the hostmonitor system to see a sensitive account password. The string containing the password also appears to be used to make the URL request. Does this mean that it is being transmitted in clear text on the internet even though it is supposed to be a secure site?

KS-Soft · Post by **KS-Soft** » Fri Mar 07, 2008 12:14 am

I don't think it is being transmitted in clear text, we will check the code today...

Regards
Alex

KS-Soft · Post by **KS-Soft** » Fri Mar 07, 2008 11:29 am

HostMonitor does not send userid:password as clear test.
Regarding "displaying the password".. we will change that behaviour. However I do not think this is a big problem. Normally you should protect HostMonitor settings using restricted permissions for operators ("User Profiles" dialog). If you provide access to test settings and Connection Manager to everyone, they can take any password...

Regards
Alex