Plain text username and password

[mothupally]

It looks like the client is passing the username and password in clear/plain text in the headers. Anyone who can perform Man-in-the-middle attack can capture client identity.

[zeroows]

To be more safe use HTTPS.