Hi, I noticed that the login page appears to submit the username and password in plaintext as URL query parameters, for example /login.html?username=...&password=....
This causes the password to be stored in browser history/search suggestions and potentially in server, proxy or container logs. Even where the app is only exposed on a LAN, this seems like a security issue.
Would you consider changing the login flow to use a POST request with credentials in the request body, and ensuring passwords are not written to URLs or logs?
Hi, I noticed that the login page appears to submit the username and password in plaintext as URL query parameters, for example /login.html?username=...&password=....
This causes the password to be stored in browser history/search suggestions and potentially in server, proxy or container logs. Even where the app is only exposed on a LAN, this seems like a security issue.
Would you consider changing the login flow to use a POST request with credentials in the request body, and ensuring passwords are not written to URLs or logs?