Kong / Kong/insomnia

Prompts not properly masked

Open
#10,311 2 comments 0 reactions 0 assignees View on GitHub
B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

"Password" prompts (those defined with the "Mask Text" checked) should not echo actual characters, but rather hide them (*****).

This has been broken for a while (6 months maybe?).

### Actual Behavior

I can see the password I enter.

### Reproduction Steps

The prompt is defined in the **Body** area...

Image

... as a **_Prompt**...

Image

Image

... but when I **Send** the request I can see what I type

Image

### Is there an existing issue for this?

- [x] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Which sync method do you use?

- [ ] Git sync.
- [ ] Insomnia Cloud sync.
- [ ] Local only

### Additional Information

_No response_

### Insomnia Version

13.0.2

### What operating system are you using?

Windows

### Operating System Version

Windows 11

### Installation method

downloaded from Insomnia.rest and auto-updated many times since

### Last Known Working Insomnia version

not sure

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue using a masked Password prompt in the request Body area and confirm that entered characters are visible after sending. Trace the prompt handling from the Body prompt configuration to the send flow; done means masked prompts display hidden characters rather than the actual password.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, typescript
Domain
frontend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.