khushi2706
Password is not encrypted when passing its value through API
We are able to see the password that the api is receiving and its not encrypted.
Can you assign this issue to me? I'm able to work on password hashing, encryption, and decryption.
@aditya-dev001 Is the issue still open? Can you assign it to me please?
Hi! @khushi2706 I noticed this issue is assigned to @maheen-fatma but there hasn't been a PR yet. If it’s okay with the maintainer and the assignee, I’d love to work on this if it’s available. Please let me know!
@vatsal633 while maheen is still working on this issue, you can work on my open source repos - https://github.com/extinctsion Please let me know if you need any help
@aditya-dev001 We currently see the password in plaintext in the frontend console logs. I have raised a PR proposing hashing the password on the frontend before sending it to the backend. However, hashing or encrypting passwords on the frontend is generally not recommended. Password encryption or hashing should be handled securely on the backend, which is already implemented in our project.
In our current setup, the raw password is sent over the network to the backend, where it is hashed and stored securely. To protect the raw password during transmission, it’s critical to use HTTPS in production, which encrypts the entire communication channel between the frontend and backend, preventing interception by attackers.