eSign and plaintext password reveal

OpenEMR Development
#1

mdsupport wrote on Tuesday, June 30, 2015:

Has anyone noticed that while authenticating an user using e-sign function, firebug will show user’s password in plain text when you examine

POST request to interface/esign/index.php?module=encounter&method=esign_form_submit

amendment
encounterId 164725
password MyPassword
table form_encounter
userId

Or is it that SSL on my servers is broken?

#2

Did this get resolved? I know it is old, but I wanted to ask. It sounds like there’s an SSL issue.

#3

That’s not a security issue. The password is sent to the server – that’s how passwords work. Firebug shows you the password because Firebug shows you requests before they’re encrypted with SSL.

1 Like