Search code examples
djangohttpsdjango-rest-frameworkdjango-authentication

Django password shows in Form Data (Post/Request)

Good evening, I would like to know if when you submit a POST request to Django with your credentials (username/email and password) is normal/save to have that info open in Form Data (dev tools google -> network -> url).

Like that:

Form data from google devtools showing username and password (Django app)

It's possible to hide that info or at least encrypt?

Many thanks in advance!

Solution

  • This isn't really a problem. Your request should be protected by HTTPS and no one can see the contents of your form post.

    Imagine you could encrypt your password on the client: if someone could see your "plaintext" password they could also see your encrypted one. Since your server decrypts that password, the theoretical attacker would just send the encrypted version instead of your "plaintext" one. The "encrypted" password is now your just another plaintext password, and we are back where we started.

    There aren't many good/easy ways to protect an encryption key on the client and maintain usability, especially not in a web app scenario. This is exactly what https/tls is designed to solve, in a general way.