Search code examples
mozillabugzilla

How to hide the plain text bugzilla password from POST request?

I have one bugzilla setup working with me. When we login to bugzilla, it sends the POST request Form Data which has password as plain text.

Form Data:

Bugzilla_login:test@gmail.com

Bugzilla_password:test

Bugzilla_login_token:

GoAheadAndLogIn:Log in

I feel this is risky and will adhere the security policies.

Is there any way to hide this plain text password?

Thanks!!

Solution

  • Host your Bugzilla service on HTTPS instead of HTTP. This is the standard way to protect passwords in transit.

    You will probably want to set up another service on the same hostname for HTTP that redirects to the HTTPS version.