primeface password is plaintext

[ronaldoronaldinho]

hi, experts, I found that although inputSecret is used for password, it is transmitted in formdata posted to server?
and solution for this case?


ronaldo ronaldinho

[MarkWinton]

inputSecret just masks the entered values in the browser, it's nothing to do with the transmitted data (which will be plain text in the submitted request's parameters, and is normal behaviour).

You're using HTTPS to secure traffic to your site though, right? In which case the password being plain text in the request parameters is a moot point.

[ronaldoronaldinho]

thanks sir. this is requirement from auditor